Breaches and incidentsBriefReported by a reputable outlet, citing the company
#StopRansomware AA26-222A: Gunra ransomware
FBI, CISA, DC3, NSA, US Secret Service and South Korea’s KNPA warn of Gunra (emerged Apr 2025, C/C++, reportedly built from leaked Conti code, RaaS...
- Disclosed
What happened
- FBI, CISA, DC3, NSA, US Secret Service and South Korea’s KNPA warn of Gunra (emerged Apr 2025, C/C++, reportedly built from leaked Conti code, RaaS affiliate program from early 2026) hitting critical infrastructure.
- Techniques: exploitation of FortiOS/FortiProxy VPN and firewall flaws (secondary reports cite CVE-2024-55591 and CVE-2025-24472), default SSL-VPN credentials, MFA bypass by tampering with a VDI OTP flow, Impacket psexec/secretsdump, NTDS hash theft, OneDrive/SharePoint collection, MEGA exfiltration, deletion of primary and DR backups.
- Attribution: the advisory (criminal RaaS).
Live scores
Live scores
CVE-2024-55591- EPSS
- 0.944
very likely to be attacked soon - VEDAS
- 0.979
strong exploit evidence - On CISA KEV
- Yes, since 2025-01-14
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-24472- EPSS
- 0.072
some chance of attack soon - VEDAS
- 0.751
some exploit evidence - On CISA KEV
- Yes, since 2025-03-18
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://www.attackiq.com/2026/08/11/response-to-aa26-222a/
- https://www.waterisac.org/tlpclear-cisa-fbi-and-partners-warn-of-gunra-ransomware
- https://www.ic3.gov/CSA/2026/260810.pdf
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.