Gunra Ransomware Exploits Unpatched Fortinet Devices and Bypasses MFA
Written by AI from the linked story. Not reviewed by an editor. How this works
The Gunra ransomware group is actively exploiting known, older vulnerabilities in Fortinet firewall and VPN appliances — meaning affected organizations had windows of opportunity to patch but did not act in time. Compounding the risk, the group leverages leaked Conti ransomware code to circumvent MFA protections, demonstrating that MFA alone is insufficient when underlying systems remain unpatched and misconfigured. This attack highlights a dangerous assumption: that implementing a single control like MFA constitutes adequate defense. Internet-facing network appliances are high-value targets, and delayed patching of these devices can expose an organization's entire network perimeter. The combination of unpatched vulnerabilities and MFA bypass capability significantly lowers the barrier for ransomware actors to compromise critical infrastructure.
Tactical Insight
Immediate actions
- Apply all available Fortinet security patches immediately, prioritizing internet-facing firewall and VPN appliances.
- Audit MFA configurations across all remote access points to identify and remediate bypass-prone implementations (e.g., legacy protocols, MFA fatigue vulnerabilities).
- Isolate unpatched Fortinet appliances from critical network segments until remediation is complete.
Long-term improvements
- Establish a formal, risk-prioritized patch management program with defined SLAs for critical CVEs on perimeter devices (e.g., patch within 24–72 hours of disclosure).
- Maintain a continuously updated inventory of all internet-facing appliances and their firmware/software versions.
- Adopt a Zero Trust architecture so that no single compromised perimeter device grants broad internal network access.
Detection measures
- Deploy continuous vulnerability scanning specifically targeting perimeter and network appliances using tools like Tenable or Qualys.
- Implement behavioral monitoring and SIEM alerting for anomalous authentication patterns, including MFA bypass indicators and lateral movement from VPN endpoints.
- Subscribe to vendor security advisories (e.g., Fortinet PSIRT) and threat intelligence feeds to receive real-time notification of exploited vulnerabilities.