The Gunra ransomware gang is actively exploiting unpatched VPNs and firewalls to infiltrate organizations, steal data, and encrypt systems for extortion purposes. The group has targeted victims across multiple critical sectors including healthcare, finance, and manufacturing. Security professionals should prioritize patching network perimeter devices to mitigate exposure to this threat.
Read full article at Graham Cluley ↗Gunra ransomware actors are leveraging Fortinet vulnerabilities to compromise critical infrastructure while employing stealth tactics to exfiltrate large volumes of data from Microsoft services. US and Korean government agencies have jointly warned of this threat activity, highlighting the use of legitimate cloud services in data theft operations.
The Gunra ransomware gang is actively exploiting known Fortinet vulnerabilities and leveraging leaked Conti code to compromise critical infrastructure targets while circumventing multi-factor authentication. The group's success against defended environments suggests that unpatched firewall and VPN appliances remain a significant attack surface, even when MFA protections are in place.
Mid-sized companies with annual revenue between $10 million and $1 billion represented 73% of publicly disclosed ransomware and data-extortion incidents in North America and Europe from January 2023 through June 2026, according to analysis by Black Kite covering 13,336 incidents. This segment's share of attacks remained consistently between 72% and 75% throughout the period, indicating that ransomware operators are deliberately targeting the mid-market as a priority.
Follow the money