Gunra Ransomware: 51 Victims After Exploiting 2 Fortinet & Schneider Flaws

For security teams, the Gunra advisory is a stark reminder that even large vendors' known vulnerabilities can become the entry point for sophisticated ransomware operations. The exploitation of a medium-voltage gear flaw alongside a firewall/proxy vulnerability shows how attackers chain weaknesses across IT and OT environments. With 51 victims already identified, defenders need to assess exposure immediately.

Cybersecurity and intelligence agencies from the United States and South Korea have issued a joint advisory warning of active exploitation by the Gunra ransomware group, which is leveraging two critical security flaws to breach networks worldwide. The vulnerabilities – CVE-2024-5559 in Schneider Electric's PowerLogic P5 medium-voltage switchgear and CVE-2025-24472 in Fortinet's FortiOS and FortiProxy appliances – provide initial access, after which attackers deploy Gunra ransomware in double-extortion operations that combine data theft with file encryption. The group threatens to publish stolen data on its leak site unless payment is made within five to seven days.

“

Cybersecurity and Infrastructure Security Agency (CISA) has underscored the urgency, with Acting Executive Assistant Director Chris Butera calling Gunra “another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S.

Emerging in April 2025, Gunra has already claimed 51 victims across sectors including healthcare, financial services, government, and critical infrastructure. The majority of victims are located in Australia, East Asia, and Europe, with only three reported from Canada and the United States – a geographic pattern that suggests a deliberate targeting strategy or the use of regional affiliates. The group relies on phishing as its primary initial access vector, delivering malicious payloads before moving laterally and encrypting large files – reportedly up to 9 terabytes – using advanced stream ciphers such as Salsa20 or ChaCha20. This technical capability points to a well-funded and operationally mature threat actor, likely derived from the notorious Conti ransomware lineage, given the presence of Conti source code.

In January 2026, Gunra formalized its business model by launching a ransomware-as-a-service (RaaS) affiliate program on dark web forums, providing partners with a complete management panel, negotiation tools, and a support infrastructure. This shift to an affiliate model dramatically increases the group’s scalability and makes it harder to attribute attacks, as multiple independent actors may now operate under the Gunra banner using the same toolset. The combination of easily exploitable public-facing vulnerabilities and a plug-and-play RaaS kit creates a high-severity risk environment for organizations that have not yet patched their Fortinet and Schneider Electric devices.

The market implications extend beyond immediate disruption. Both Fortinet and Schneider Electric face potential reputational damage and, depending on contractual obligations and liability claims, direct financial exposure. For end-user organizations, particularly those in critical infrastructure and healthcare, the cost of an incident can run into millions of dollars from downtime, remediation, regulatory fines, and ransom payments. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has underscored the urgency, with Acting Executive Assistant Director Chris Butera calling Gunra “another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations.”