South Korea's and the United States' cybersecurity and intelligence agencies issued a warning about Gunra ransomware assaults that target critical infrastructure sectors and organizations worldwide. Attacks using the ransomware have exploited security flaws in Schneider Electric PowerLogic P5 (ENTITY_0) and Fortinet FortiOS and FortiProxy (ENTITY_1) appliances to gain initial access, then deploy the Gunra ransomware as part of a double extortion scheme that combines data exfiltration and encryption for maximum impact. In a case uncovered by South Korea's National Police Agency (KNPA), attackers have been identified manipulating network traffic control features on an SSL-VPN appliance to intercept credentials and session information transmitted during corporate VDI authentication portal user logins.
To circumvent multi-factor authentication (MFA) measures, Gunra is alleged to have tampered with authentication processing files on a server hosting the corporate VDI login portal, enabling successful authentication when a specific one-time password (OTP) value was entered. Accessing a Hiware system access control server via SSH from a compromised virtual desktop, stealing a symmetric encryption key to decrypt passwords on enterprise servers stored in databases and perform credential dumping of credentials associated with all enterprises. The disclosure is significant given recent advisories about an unspecified cyber campaign targeting South Korea from 2025-2026, exploiting vulnerabilities in unidentified financial security software to distribute malware through spear-phishing and watering hole techniques.
