jain.com — data centers, connectivity and security, analyzed daily

Tag: VPN security

  • Gunra’s 10 p.m.–6 a.m. Pattern Shows Why Edge Appliance Logs Belong Off the Box

    Gunra’s 10 p.m.–6 a.m. Pattern Shows Why Edge Appliance Logs Belong Off the Box

    TL;DR · 30-second read

    The Short Version

    Government agencies in the United States and South Korea have jointly warned about a criminal hacking group called Gunra. It breaks into organizations, copies their private files, locks everything up, then demands payment, threatening to publish or sell the stolen files if victims refuse.

    Its main way in is the security equipment that lets employees log in to work networks from home. Once inside, it erases its tracks and works overnight, between 10 at night and 6 in the morning.

    Hospitals, banks, utilities and universities are among its targets. One bright spot: a flaw in one version lets some victims unlock files without paying.

    Industrial Cyber reported that the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Defense Cyber Crime Center (DC3), the National Security Agency (NSA), the US Secret Service and South Korea’s National Police Agency (KNPA) released a joint advisory Monday on Gunra, a ransomware operation derived from leaked Conti source code. Gunra steals data, encrypts systems and threatens to publish or sell the stolen data on its leak site, with victims listed across the Americas, Europe, the Middle East, Africa and the Asia-Pacific region.

    The advisory says Gunra gets in mainly by exploiting known flaws in internet-facing firewall and VPN appliances, including two authentication-bypass vulnerabilities in specific FortiOS and FortiProxy versions (CVE-2024-55591 and CVE-2025-24472), deletes logs to hide, and works primarily between 10 p.m. and 6 a.m.

    Executive Summary

    Six US and South Korean agencies have published a detailed account of how Gunra ransomware operates, from initial access to extortion. Gunra emerged in April 2025, added a Linux variant by mid-2025, and by early 2026 had become a ransomware-as-a-service operation that recruits affiliates on dark web forums. Its leak site lists victims in more than ten sectors, including healthcare, finance, utilities, transportation and government.

    For infrastructure operators, the advisory’s significance is where the attack begins and how it hides. Entry runs through the edge: firewall and VPN appliances with known vulnerabilities, default credentials or weak access controls. Once inside, the actors delete system and network access logs, clear command history, work overnight and run an encryptor that produces no observable network indicators. That combination leaves appliance logs held somewhere the attacker cannot reach, and watched after hours, among the most useful signals a defender has.

    The advisory also contains a rare point in defenders’ favor: as of March 2026, Gunra’s Linux variants use weak, time-seeded randomness that lets encryption keys be reconstructed and files recovered without payment, though that does nothing about data already stolen.

    The Front Door Is the Security Appliance Itself

    The most consequential detail for infrastructure operators is how Gunra gets in. The FBI observed the group obtaining initial access primarily by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN appliances, and named two authentication-bypass flaws in specific FortiOS and FortiProxy versions: CVE-2024-55591 and CVE-2025-24472. An authentication bypass lets an attacker reach functions that should require a login without valid credentials. South Korea’s National Police Agency separately observed Gunra exploiting credential exposure and Secure Shell (SSH) access-control weaknesses on internet-facing VPN gateways.

    The intrusion the agencies describe shows how modest the first step can be: default credentials on an SSL-VPN appliance, the encrypted gateway remote staff use to reach internal systems, with no account lockout to stop repeated guessing. After compromising an administrator workstation, the actors reached the appliance’s administrative console, found an unused account with access to both external and internal networks, and modified it to skip a mandatory password change, creating a persistent backdoor that looks like an ordinary account.

    For data center, colocation and network operators, firewalls and VPN concentrators sit at the boundary of nearly everything they run, including remote administration paths into their own environments. Because both named CVEs are known vulnerabilities, the defense here is patch cadence and asset inventory rather than anything exotic. The practical test is whether an operator can list every internet-facing appliance it owns, its firmware version and every account configured on it, including dormant ones.

    Why Edge Appliance Logs Belong Off the Box

    Gunra is built to leave few traces where defenders usually look. According to the advisory, the actors delete system and network access logs and clear command history while active, conduct reconnaissance and encryption primarily between 10 p.m. and 6 a.m., and run the encryptor as a self-contained binary that produces no observable network indicators. Data is exfiltrated before encryption, so by the time files lock, the extortion leverage has already left the network.

    Taken together, those facts narrow the useful evidence to a short list, and the advisory’s own incident-response guidance points at it: review network appliance logs for anomalous privileged activity and audit file creation to detect exfiltration. Logs that exist only on the compromised appliance or host are exactly what the actors delete. Logs forwarded in near real time to a separate, access-controlled collector survive that deletion, and they only help if someone, or an automated rule, is watching during the overnight window the group favors.

    This falls hardest on organizations that run round-the-clock infrastructure with thin overnight staffing, and on managed service providers that administer appliances for many customers. An after-hours login to a VPN administrative console, a dormant account suddenly modified, or a change to appliance traffic controls are low-volume events that are straightforward to alert on, provided the record sits where the attacker cannot erase it. None of this is new practice, but Gunra’s combination of edge entry, log wiping and night-time activity turns off-device logging from a best-practice line item into the difference between catching the intrusion before encryption and discovering it from a ransom note.

    MFA and Credentials Fail at the Seams

    The advisory is a reminder that multi-factor authentication (MFA) protects a login step, not the systems behind it. Against one victim, Gunra modified files on the virtual desktop infrastructure (VDI) authentication portal, the gateway to remotely hosted desktops, so it would accept a designated one-time password. The actors also manipulated SSL-VPN traffic controls to harvest credentials and session cookies, hijacked sessions to impersonate legitimate users, and entered the internal VDI environment with stolen session tokens.

    Inside, the playbook targets the identity core. Using Impacket libraries over SMB, the Windows file-sharing protocol, the actors moved laterally to the VDI authentication server, the Active Directory server that governs who can access what, and IT staff desktops. They ran secretsdump.py against the NTDS database where domain controllers store password hashes, enabling pass-the-hash and pass-the-ticket attacks that reuse stolen credentials without cracking them. At one victim they reached a Hiware system access control server over SSH and stole the symmetric key needed to decrypt enterprise server credentials stored in its database.

    The operational lesson is that authentication portals, privileged-access systems and key stores are high-value targets in their own right and warrant the same integrity monitoring and segmentation as production systems. The agencies’ recommendations map onto each step: least-privilege administrative rights, audits for unrecognized accounts, MFA on all services with emphasis on VPNs and webmail, network segmentation to restrict lateral movement, and disabling command-line and scripting activity where possible.

    A Flaw in the Linux Encryptor, With Limits

    One finding cuts in defenders’ favor. As of March 2026, the advisory says, Gunra’s Linux ELF variants use a weak pseudorandom number generator seeded with predictable system time, allowing defenders to mathematically reconstruct keys from file timestamps and recover files without paying. That is relevant to infrastructure operators because Linux underpins much of the server estate, and Gunra introduced its Linux variant in mid-2025 as it moved toward cross-platform targeting.

    The limits matter. The weakness is described for the Linux variants as of a specific date, and ransomware-as-a-service operations, which rent their tooling to affiliates, can ship revised builds. Key recovery also does nothing about stolen data: the threat to publish or sell it stands regardless. Offline, immutable backups kept in a physically separate, segmented location, and tested, remain the control that makes recovery independent of both the attacker’s cooperation and the attacker’s mistakes.

    Background

    Gunra traces its code to Conti, a prolific ransomware operation whose source code leaked in 2022 and has since been reused by several groups. Gunra appeared in April 2025 focused on Windows systems, introduced a Linux variant by mid-2025, and by early 2026 had adopted a ransomware-as-a-service model, in which core developers supply the malware and infrastructure while recruited affiliates carry out intrusions in exchange for a share of ransoms.

    Joint advisories from US agencies and foreign partners are a standard way of publishing attacker techniques, indicators and mitigations for a specific ransomware family. They typically align recommendations with CISA and NIST’s cross-sector cybersecurity performance goals, a baseline of practices such as patching internet-facing systems, maintaining offline backups, enforcing multi-factor authentication and segmenting networks.

    Sources

    Source: Gunra ransomware expands globally as US, South Korean agencies warn of data theft, encryption and extortion tactics — Industrial Cyber’s report on the joint FBI, CISA, DC3, NSA, Secret Service and Korean National Police Agency advisory on Gunra ransomware.

  • FortiBleed Credential Leak Puts Maritime and Energy Infrastructure on Alert

    FortiBleed Credential Leak Puts Maritime and Energy Infrastructure on Alert

    Maritime cybersecurity firm Cydome has warned that a credential leak dubbed “FortiBleed” poses elevated risks to maritime and energy critical infrastructure, according to a July 6, 2026 report in trade publication Industrial Cyber. The name follows the convention of earlier incidents involving Fortinet-family network security appliances, which are widely deployed as VPN gateways and firewalls at the network edge of ships, ports, and utilities.

    Executive Summary

    The core claim is straightforward: a set of leaked credentials associated with perimeter security devices is circulating, and Cydome assesses that maritime operators and energy providers are among the sectors most exposed. Leaked credentials for firewalls and VPN concentrators are especially dangerous because those devices sit at the boundary between the public internet and internal networks — a valid login can hand an attacker the same doorway that remote employees and vendors use, with no exploit required.

    The available reporting is thin on specifics. It does not enumerate how many credentials leaked, how they were obtained, which product lines or firmware versions are implicated, or whether the vendor has confirmed the incident. What makes the warning worth attention anyway is the sector focus: maritime and energy operators run operational technology (OT) — the systems that move cargo, steer vessels, and keep power flowing — behind exactly the class of edge devices a credential leak of this kind would unlock. For critical infrastructure, credential hygiene at the network perimeter is not an IT housekeeping item; it is a safety and continuity issue.

    Why Leaked Edge-Device Credentials Are a Skeleton Key

    Firewalls and VPN gateways are the locks on the front door of a network, and a credential leak turns the lock with its own key. Unlike a software vulnerability, which a patch can close, a leaked username and password remains valid until someone rotates it — and organizations are historically slow to rotate credentials on infrastructure devices, because doing so risks disrupting the remote access that operations depend on. Prior leaks of VPN credentials in the security-appliance market showed a long tail: credentials harvested years earlier kept working because operators patched the software flaw but never reset the passwords exposed through it.

    That dynamic is why credential leaks consistently outlast the news cycle that announces them. An attacker with a valid VPN login does not need to “hack” anything in the conventional sense; they authenticate, and from the network’s point of view they look like a legitimate remote user. Detection then depends on behavioral monitoring most industrial operators do not yet have.

    Maritime and Energy: Where IT Exposure Becomes Physical Risk

    Cydome’s sector framing matters because maritime and energy networks increasingly blend information technology with operational technology. A modern vessel is a floating industrial network — navigation, engine management, ballast, and cargo systems — reachable through satellite links that are commonly fronted by exactly the kind of compact security appliance implicated by the FortiBleed name. Ports and terminals mirror that architecture ashore, and energy utilities use similar edge devices to connect substations and remote facilities to control centers.

    In these environments, a compromised perimeter is not just a data-breach risk. Access to OT networks can translate into disrupted cargo operations, degraded situational awareness at sea, or interference with grid-connected equipment. Regulators have been moving in this direction — maritime authorities and energy-sector rules increasingly treat cyber risk as an operational safety matter — and a credential leak affecting perimeter devices is a concrete test of whether those frameworks change behavior in practice.

    Supply-Chain Credential Hygiene Is Grid Security

    The deeper issue FortiBleed illustrates is that critical infrastructure inherits the credential hygiene of its entire supply chain. Ship managers, port terminals, and utilities rely on integrators, equipment vendors, and managed service providers who hold remote-access credentials into operational networks. Every one of those relationships is a place where a credential can leak, be reused across customers, or sit unrotated for years. A leak attached to a single widely deployed product line therefore propagates across thousands of unrelated organizations at once.

    The practical countermeasures are unglamorous and well established: multi-factor authentication on every remote-access path, credential rotation tied to patch events, per-vendor accounts rather than shared logins, and monitoring for logins from unexpected locations. The persistent gap between that checklist and field reality — especially on vessels and remote energy sites with limited IT staff — is the actual risk surface this warning describes.

    Reading a Vendor Warning With Appropriate Care

    It is worth being clear-eyed about the source. Cydome sells maritime cybersecurity services, so it has a commercial interest in maritime operators taking this threat seriously — which does not make the warning wrong, but does mean the burden of specifics matters. The available report, as surfaced through aggregation, provides the assessment but not the underlying evidence: no credential counts, no confirmed victim organizations, no vendor confirmation, and no indication of observed exploitation against maritime or energy targets.

    The prudent posture for operators is to treat the warning as a prompt for verification rather than a verdict: check whether your perimeter devices are on current firmware, whether credentials have been rotated since the last relevant advisory, and whether MFA actually covers every remote-access path — steps that are worthwhile whether or not this particular leak ultimately proves as severe as its framing suggests.

    Background

    Perimeter security appliances — firewalls and VPN gateways from a handful of major vendors — have become one of the most attacked categories in enterprise infrastructure, precisely because they are internet-facing by design and guard the way in. The market has seen repeated cycles in which appliance vulnerabilities led to harvested credentials that circulated in criminal forums long after the underlying flaws were patched, and government cyber agencies have repeatedly urged operators to rotate credentials, not just update firmware, after such incidents.

    Maritime and energy have meanwhile become focal sectors for industrial cybersecurity as ships, ports, and grids digitized faster than their security practices matured. Specialist firms such as Cydome emerged to serve the maritime niche, and trade outlets like Industrial Cyber track the intersection of these leaks with critical infrastructure — the context in which the FortiBleed warning landed in July 2026.

    Source: Cydome reports FortiBleed credential leak poses elevated risks to maritime and energy critical infrastructure — Industrial Cyber’s July 6, 2026 report on a maritime cybersecurity vendor’s warning about leaked network-appliance credentials.