Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure

A joint US–Republic of Korea advisory warns that the Gunra ransomware-as-a-service group (also known as Golden Community) actively exploits two legacy Fortinet authentication bypass vulnerabilities to gain super-admin access, then uses authentication bypasses, credential theft, and stealthy lateral movement to exfiltrate large volumes of data (including tens of terabytes from Microsoft 365) and demand multi‑million dollar ransoms; the advisory urges patching, immutable offline backups, and network segmentation.