[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_6ttxtqObosCXIysbMC1ityhRfk375ZzV7j8MRu-xZE":3},{"article":4,"iocs":48,"watch_terms":55,"solutions":56,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"c0c979ec-54f7-4ed8-85d1-af2078e876c3","Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA","gunra-ransomware-gang-exploits-fortinet-flaws-bypasses-mfa-555682","The ransomware-as-a-service operation is finding success against critical infrastructure targets with leaked Conti code and old flaws in firewalls and VPN appliances.","The Gunra ransomware-as-a-service operation is actively exploiting older vulnerabilities in Fortinet firewall and VPN appliances to gain access to critical infrastructure targets. Leveraging leaked Conti ransomware code, the group has demonstrated an ability to bypass multi-factor authentication (MFA) mechanisms, increasing its success rate against organizations that have implemented such security measures.","Gunra ransomware gang uses Fortinet flaws and leaked Conti code to target critical infrastructure.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fgunra-ransomware-gang-fortinet-flaws-bypasses-mfa","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt468a31de0930ebef\u002F6a7b87a0f0b097cbb1a7bb39\u002Fransomware-jittawit.21-Getty-2178699306.jpg?width=720&quality=80&disable=upscale","2026-08-11T21:16:25+00:00","2026-08-11T22:00:08.793072+00:00",8,[17,20,22],{"name":18,"type":19},"Fortinet firewall","product",{"name":21,"type":19},"Fortinet VPN appliance",{"name":23,"type":24},"Gunra","threat_actor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":25,"icon":27,"name":28,"slug":29},null,"Ransomware","ransomware",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,52],{"type":50,"value":23,"context":51},"malware","Ransomware-as-a-service operation",{"type":50,"value":53,"context":54},"Conti","Leaked code used by Gunra",[18,21],{"controls":57,"vendors":142},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":88,"name":89,"problem":90,"products":91},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":117,"name":118,"problem":119,"products":120},"patch-management","Automated patch management","Known holes get closed in days, not months.",[121,126,134],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":122,"product_name":123,"url":124,"description":125},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",[143],{"slug":144,"name":145,"logo_path":146,"roles":147},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":165},"gunra-ransomware-exploits-unpatched-fortinet-devices-and-bypasses-mfa","Gunra Ransomware Exploits Unpatched Fortinet Devices and Bypasses MFA","The Gunra ransomware group is actively exploiting known, older vulnerabilities in Fortinet firewall and VPN appliances — meaning affected organizations had windows of opportunity to patch but did not act in time. Compounding the risk, the group leverages leaked Conti ransomware code to circumvent MFA protections, demonstrating that MFA alone is insufficient when underlying systems remain unpatched and misconfigured. This attack highlights a dangerous assumption: that implementing a single control like MFA constitutes adequate defense. Internet-facing network appliances are high-value targets, and delayed patching of these devices can expose an organization's entire network perimeter. The combination of unpatched vulnerabilities and MFA bypass capability significantly lowers the barrier for ransomware actors to compromise critical infrastructure.",[154,155,156,157,158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 AC-17: Remote Access","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF PR.AC-3: Remote Access Managed","ITIL Change Management: Emergency Change Procedures","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1556: Modify Authentication Process",{}]