The group demonstrates high technical proficiency, including manipulating VDI and SSL-VPN authentication flows to bypass MFA and harvesting sensitive configuration data from enterprise environments. They use a mix of native tools, Impacket libraries, and custom payloads to facilitate lateral movement, credential dumping, and mass exfiltration of business data. Despite a identified cryptographic weakness in Linux variants, the group remains a significant threat due to their aggressive recruiting of initial access brokers and ability to deploy ransomware rapidly against database servers and NAS systems.

Attack Chain

1. Initial access is established by exploiting known vulnerabilities (CVE-2024-5559 or CVE-2025-24472) in internet-facing Schneider Electric or Fortinet appliances.
2. Attackers gain administrative access to SSL-VPN or VDI portals, often by manipulating authentication files to enable bypasses or using default credentials.
3. Persistent access is maintained by downloading OpenSSH and configuring backdoors on compromised appliances.
4. Internal reconnaissance is conducted using compromised credentials to identify domain controllers and enterprise server infrastructure.
5. Lateral movement is performed using Impacket tools such as psexec.py and smbclient.py, while secretsdump.py is utilized to extract credentials from NTDS files.
6. Data is exfiltrated from Microsoft OneDrive, SharePoint, and VDI environments using a custom executable named 'main.exe' or via large compressed archives to MEGA.
7. Backup and recovery infrastructure is identified and systematically deleted to prevent restoration.
8. Final objective is achieved by deploying ransomware payloads to encrypt database servers, NAS systems, and critical enterprise assets.

Impact

Gunra has successfully targeted at least 51 victims across South Korea, Brazil, Spain, Thailand, and Hong Kong since April 2025. The attack impacts critical sectors by causing severe operational disruption and potential long-term data loss through unauthorized disclosure. Organizations that refuse to pay the ransom face the permanent leakage of sensitive business data on public forums, impacting regulatory compliance and reputation.

Recommendation

• Patch CVE-2024-5559 on all internet-facing Schneider Electric PowerLogic P5 devices immediately.
• Patch CVE-2025-24472 on all Fortinet FortiOS and FortiProxy appliances to prevent initial exploitation.
• Implement strict network segmentation and monitor for unauthorized lateral movement involving Impacket tools and SMB traffic.
• Audit VDI and SSL-VPN authentication portals for modified configuration files or anomalous MFA bypass logic.
• Deploy immutable, off-site backups to ensure business continuity following potential ransomware deployment.