CISA, the FBI, the Department of Defense Cyber Crime Center, the NSA, the US Secret Service, and South Korea’s National Police Agency issued a joint advisory on August 10 warning that the Gunra ransomware group is exploiting two known Fortinet authentication-bypass flaws, CVE-2024-55591 and CVE-2025-24472, to break into FortiOS and FortiProxy appliances and then defeat multi-factor authentication outright. Gunra, built on leaked Conti ransomware source code and first observed in April 2025, has hit hospitals, government agencies, and financial institutions across the Americas, Europe, the Middle East, Africa, and the Asia-Pacific region.
Why it matters: this is not a token-theft or phishing-based MFA bypass. The advisory describes Gunra actors modifying authentication-processing files directly on compromised corporate VDI portals, so that a one-time password chosen by the attacker is accepted every time, turning MFA into a formality rather than a control. That technique works regardless of which MFA method a victim organization has deployed, because it rewrites what “correct” looks like at the server rather than trying to intercept or phish a code.
The original insight worth flagging to Linux-heavy environments: the advisory also disclosed a weakness in Gunra’s Linux encryption scheme, where victims may be able to reconstruct decryption keys from file timestamps alone, without paying a ransom. Combined with two Fortinet CVEs that have been public and patchable for well over a year, this incident is less a story about a sophisticated new technique and more about the same unpatched edge devices that keep showing up in CISA’s exploited-vulnerability advisories. Security teams still running affected FortiOS or FortiProxy builds should patch immediately and audit VDI authentication files for unauthorized modification, not just rotate credentials, a lesson that echoes the passwordless authentication risks CyberTech has covered.
Source: CISA (Advisory AA26-222A)
