#StopRansomware: Gunra — The Conti-Child Whose Backup Advice Is Aimed Right At Us

The Conti kid grows up//

AA26-222A landed on 2026-08-10, signed by FBI, CISA, DC3, NSA, USSS, and Korea's KNPA — six agencies on one ransomware family is the government saying "we saw it on both sides of the Pacific and it's getting worse."

Gunra first emerged in April 2025 as a double-extortion variant derived from the leaked Conti source code. The Conti kid, in other words. In January 2026 it went RaaS: a dark-web affiliate program (alias Golden Community) with a management panel, a configurable ransomware builder, cross-platform locker payloads, and affiliate documentation. The commercialization is the interesting bit — Gunra is recruiting penetration testers and ethical hackers as initial-access brokers, paying a share of the ransom for enterprise network access. The people selling you access are literally the people who got paid to test your network.

The model: exfiltrate first, encrypt second, negotiate over qTox against a Tor negotiation portal, five-to-seven-day clock, leak site as the deadline's teeth. Victims are listed across the Americas, Europe, Middle East, Africa, and Asia-Pacific — healthcare, finance, manufacturing, transport, government.

The front door: your FortiOS box//

The FBI observed initial access primarily through known vulnerabilities in internet-facing appliances, specifically FortiOS/FortiProxy authentication bypasses:

• CVE-2024-55591
• CVE-2025-24472

Both are already in KEV — they're not new CVEs, they're the CVEs. Per the advisory's detection table, they let an attacker exploit a scheduled task on the vulnerable device to create a new persistent superuser forticloud-sync with a hard-coded password. Name it like a legitimate sync account and it sits in your appliance account list looking innocent.

The pattern: your edge appliance is the thing attackers scan for first, it's the thing that rarely gets patched (because "it works, don't touch it"), and it's the one foothold that puts you inside the whole LAN. The advisory's mitigation list leads with it for a reason.

The MFA backdoor: one OTP that never changes//

Against one victim, Gunra actors modified the authentication processing files on a corporate VDI auth-portal server so that one specific, Gunra-designated OTP value always authenticates successfully.

Read that again: this is a standing MFA backdoor. The victim can reset every password, re-enroll every token, rotate every credential in the org — and the attacker just keeps typing the same number. It's MITRE T1556.006 (Modify Authentication Process: MFA), and it's the exact move that makes "we turned on MFA" a false sense of security if the MFA service itself is on the compromised network.

The adjacent behavior in the same victim: default credentials on an SSL-VPN appliance (no account lockout), an unused account with access to both internet-facing and internal networks whose forced password change was modified off, and session-cookie hijacking to impersonate users. Every one of those is a "small config detail" that becomes a beachhead.

The IR twist: don't wipe the .GNRA box//

Here's the part that should make every Linux box with a .GNRA-extension file lean back in its chair. Per Breakglass Intelligence (2026-03-12), the Gunra Linux ELF variants seed their PRNG with srand(time(NULL)), a predictable, timestamp-seeded random number generator.

The upshot, per the advisory: the encryption keys can be mathematically reconstructed from file timestamps, meaning you can recover the files without paying the ransom.

The advisory's incident-response step is blunt: if the incident involves the Gunra Linux variant, preserve the encrypted files, file timestamps, the ransom notes, and the relevant system logs before you rebuild. Rebuilding destroys the timestamps, and the timestamps are the keys.

What the advisory tells you to do//

The Key Actions from the advisory, in the government's own bolding:

1. Prioritize patching known exploited vulnerabilities in internet-facing systems — specifically VPN gateways and RDP-exposed infrastructure, including the two FortiOS/FortiProxy CVEs above.
2. Implement and test offline, immutable backups stored in a physically separate, segmented location — recoverability without ransom payment is the whole point.
3. Segment networks to restrict lateral movement from the initially compromised device.

The detection tables add the two hunts that are directly actionable on a homelab:

• Enumerate your edge appliance's accounts for forticloud-sync (or anything that looks like a sync/daemon account you don't recognize).
• Check your auth server's change history — an auth-portal whose processing files changed and whose MFA now "always works" for one value is a backdoor, not a coincidence.

The good news for Linux//

The .GNRA/PRNG flaw is a gift, but only if you preserve evidence. And the counterintuitive IR rule (don't rebuild, recover first) is the one that'll separate the people who pay from the people who don't.

The whole thing is, again, a checklist you can run tonight: patch the edge, make the backups immutable and test them, segment the LAN. Same shape as the last three advisories. The government keeps saying the same sentence because we keep ignoring it.

(Cross-link: ctipilot.ch has a writeup — it's self-labeled "AI-generated, no human review," so treat it as corroboration, not a primary source. Everything load-bearing above is in the CISA advisory and PDF.)