Feds warn Gunra ransomware is exploiting known bugs to hit critical infrastructure

CISA and partners say Gunra affiliates are walking into Fortinet holes and ransoming hospitals and agencies.

Summary

US agencies including CISA, FBI, NSA, and Secret Service warned that Gunra ransomware affiliates are hitting critical infrastructure.
Attackers exploit known Fortinet FortiOS/FortiProxy authentication bypass bugs, including CVE-2024-55591 and CVE-2025-24472.
Gunra operates as ransomware-as-a-service with double extortion: steal, encrypt, then ransom on a Tor portal.
Targets already include healthcare, finance, government, and other critical sectors in the US and abroad.
Victims are typically given five to seven days before stolen data is threatened with publication.

Known bugs on internet-facing firewalls are not bad luck. They are unpaid homework by operators who guard real life.

Critical infrastructure is a China-and-crime problem set. Patch, segment, and prosecute. Do not write another awareness pamphlet.

A country that cannot keep hospitals online will not keep a border or a fleet online either.

Why are known Fortinet bugs still feeding ransomware?

u/soc_night · 5h

If CVE is old and the firewall is public, that is negligence with lives attached.

u/midwest_vet · 4h

Hospitals and water plants are war targets even when the actor is a crew.

u/campus_take · 4h

Feelings are not a clearance. CISA and partners say Gunra affiliates are walking into Fortinet holes and ransoming hospitals and agencies.

u/rule_first · 3h

Vendors ship patches. Operators must apply them. Both can be held accountable.

u/tokyo_ally · 3h

Japan's plants face the same RaaS economy. Shared intel, faster patch SLAs.

u/aid_fan · 2h

USAID talking points are not a remedy. CISA and partners say Gunra affiliates are walking into Fortinet holes and ransoming hospitals and agencies.

u/docket_rat · 2h

NGOs do not patch Fortinet. Network owners and FBI tasking do.

u/border_dad · 90m

Digital borders are borders. Leave them open and criminals walk in.

u/press_clip · 70m

u/night_shift · 40m

Patch today. Hunt affiliates tomorrow.

Paraphrased comments. Not attributed.