this ransomware gang doesn't crack your MFA. it just tells the server to say yes

Six government agencies just told the world that a ransomware crew called Gunra found a way to make multi-factor authentication meaningless — not by stealing a code, but by rewriting the file that checks it. CISA, the FBI and South Korea's National Police Agency published a joint advisory on August 11, 2026 confirming Gunra breaks into networks through two already-known Fortinet bugs, then edits the authentication logic on the victim's own VDI portal so a single attacker-chosen one-time password logs in every single time.

Two old bugs, still doing damage

Neither Fortinet flaw is new. CVE-2024-55591 has been actively exploited since November 2024 and lets a remote, unauthenticated attacker send crafted requests to FortiOS's Node.js websocket module and walk away with super-admin privileges. CVE-2025-24472, disclosed in February 2025, does something similar through crafted CSF proxy requests when Security Fabric is enabled — an attacker who already knows an upstream and downstream device's serial numbers can grant themselves super-admin on the downstream box. Both have sat in CISA's Known Exploited Vulnerabilities catalog for over a year.

The part that should actually worry you: how they killed MFA

In one intrusion the advisory describes in detail, attackers compromised an SSL-VPN administrator account that still used default credentials with no lockout controls. From there, instead of stealing a one-time code or phishing for one, they modified the authentication files on the corporate VDI portal directly, so that a specific, Gunra-chosen OTP value would always be accepted as valid. Every login attempt using that value succeeded, for any account, indefinitely — MFA wasn't bypassed so much as switched off from the server side.

Who Gunra actually hits, and what happens next

Gunra emerged in April 2025 and is assessed to derive from the leaked Conti ransomware source code, though it now runs as its own ransomware-as-a-service operation, launching a formal affiliate program in January 2026 under aliases including Golden Community. It runs a double-extortion model — steal the data, encrypt the network, give the victim five to seven days before publishing on its leak site. There's one bright spot: researchers found a cryptographic weakness in Gunra's Linux encryptor back in March 2026 that can allow key recovery in some cases. The Windows variant has no such shortcut.

This isn't the first time an edge appliance became a ransomware entry point this year — SonicWall's SMA 1000 line had root access sitting exposed for weeks before Inc ransomware noticed, and CareCloud's four-month breach notification gap shows what happens after — victims often don't find out for months. If your org has ever exposed Fortinet management interfaces to the internet, the honest move is to assume compromise and audit, not just patch and move on.

CISA's joint advisory doesn't name specific victims, and Gunra's leak site is the only public confirmation most targets will get. My honest read: the interesting part of this story isn't Gunra, it's that two Fortinet bugs from late 2024 and early 2025 are still doing damage in August 2026. Old, patched, well-documented vulnerabilities keep being how ransomware crews get in, because 'patched' and 'actually patched everywhere' are different states for most large organizations.