Gunra Ransomware Uses Multithreaded ChaCha20 Encryption

Summary

Gunra is a Ransomware-as-a-Service (RaaS) family derived from leaked Conti source code and designed to target both Windows and Linux systems. The operators use double extortion tactics, stealing large volumes of data to cloud services before launching file encryption. Gunra relies on ChaCha20 combined with RSA-4096 encryption and appends the .ENCRT extension to encrypted files.

Investigation

The report explains how Gunra operators gain initial access by exploiting FortiOS vulnerabilities and creating persistent superuser accounts. Investigations show the attackers use Impacket libraries for lateral movement and SMB abuse, while also stealing credentials from VDI and Hiware systems. They further manipulate MFA configurations to preserve long-term access to compromised environments.

Mitigation

Organizations should patch FortiOS and FortiProxy systems against CVE-2024-55591 and CVE-2025-24472. Security teams should monitor for unauthorized accounts such as forticloud-sync and detect suspicious use of Impacket tools. Protecting volume shadow copies and validating MFA and authentication configuration files are also critical defensive measures.

Response

If Gunra activity is detected, affected systems should be isolated immediately to limit lateral movement over SMB or RDP. Unauthorized superuser accounts should be revoked, and authentication processing files should be reviewed for MFA backdoors. Organizations should reset enterprise credentials and investigate cloud storage activity for signs of unauthorized data exfiltration.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has successfully leveraged a chain of vulnerabilities (CVE-2024-55591 and CVE-2025-24472) to bypass authentication on a FortiOS device. To ensure long-term access (persistence), the attacker executes a command to create a new user account. To blend in with legitimate system processes and cloud synchronization services, the attacker names the account ‘forticloud-sync’. This action generates a Windows Event ID 4720 on the integrated identity provider, which is the primary target of our detection rule.

• Regression Test Script:

  # Simulation script to mimic the creation of the 'forticloud-sync' account for persistence.
  # NOTE: This must be run with Administrative privileges.
  
  $TargetUser = "forticloud-sync"
  $Password = ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force
  
  Write-Host "[+] Starting Simulation: Creating account $TargetUser" -ForegroundColor Cyan
  
  try {
      New-LocalUser -Name $TargetUser -Password $Password -Description "Automated cloud sync service account" -FullName "FortiCloud Sync Service"
      Write-Host "[!] SUCCESS: Account '$TargetUser' created. Check SIEM for Event ID 4720." -ForegroundColor Green
  }
  catch {
      Write-Host "[-] FAILURE: Could not create account. Ensure you are running as Administrator." -ForegroundColor Red
      Write-Error $_
  }

• Cleanup Commands:

  # Cleanup script to remove the simulated account and restore environment state.
  $TargetUser = "forticloud-sync"
  
  Write-Host "[+] Starting Cleanup: Removing account $TargetUser" -ForegroundColor Cyan
  
  try {
      Remove-LocalUser -Name $TargetUser
      Write-Host "[!] SUCCESS: Account '$TargetUser' removed." -ForegroundColor Green
  }
  catch {
      Write-Host "[-] FAILURE: Could not remove account. It may have already been deleted." -ForegroundColor Red
  }