gunra ransomware

The gunra ransomware tag covers reporting on an operation targeting enterprise environments through exposed FortiGate and SSL-VPN infrastructure, authentication-bypass flaws, stolen VPN sessions, and compromised identities. Tagged coverage examines movement into Windows domains, Active Directory, VDI, database servers, NAS systems, and cloud services including Microsoft OneDrive and SharePoint. It also addresses data theft, file encryption, and the deletion of primary and disaster-recovery backups before or after deployment. These incidents highlight how shared identities, replication paths, and management systems can expose recovery environments, even when Windows systems are patched. The coverage also notes Gunra’s Linux payloads and its use of common Windows administration tooling.