Gunra ransomware actors are leveraging Fortinet vulnerabilities to compromise critical infrastructure while employing stealth tactics to exfiltrate large volumes of data from Microsoft services. US and Korean government agencies have jointly warned of this threat activity, highlighting the use of legitimate cloud services in data theft operations.
Read full article at Infosecurity Magazine ↗The Gunra ransomware gang is actively exploiting known Fortinet vulnerabilities and leveraging leaked Conti code to compromise critical infrastructure targets while circumventing multi-factor authentication. The group's success against defended environments suggests that unpatched firewall and VPN appliances remain a significant attack surface, even when MFA protections are in place.
Follow the money
Because apparently even ransomware gangs can't trust the people they do business with
These companies often have the hardest time balancing their roles as suppliers and customers, according to the risk management firm Black Kite.