CVE-2024-55591Active Exploitation(fortinet / fortios)

Afiliado “hastalamuerte” reveló TTP de Gentleman y disputas internas. Explotan RDWeb, SSL VPN y CVE-2024-55591 en Fortinet para omitir autenticación y comprometer redes. Mas información: https://www.ecucert.gob.ec/wp-content/uploads/2026/03/Al-2026-015-Grupo-Ransomware-Gentlemen.pdf #PorUnEcuadorCiberseguro @Arcotel_ec @CsirtCEDIA @CsirtEPN https://t.co/GrLELCllCu

⚠️ BAD - U.S., U.K., and South Korean authorities jointly warned that Gunra ransomware actors are actively exploiting Fortinet FortiOS and FortiProxy flaws (CVE-2024-55591 and CVE-2025-24472) to gain initial access to critical infrastructure networks. - The Conti-derived RaaS operation uses a double extortion model exfiltrating terabytes of data before encrypting systems and has listed 51 victims since emerging in April 2025, spanning healthcare, financial services, and government sectors. - Gunra actors have been observed bypassing MFA, hijacking SSL-VPN sessions, deleting backup infrastructure at both primary and disaster recovery sites, and operating exclusively between 10 p.m. and 6 a.m. to evade detection.

Gunra ransomware, built on leaked Conti source code, exploits FortiOS auth-bypass flaws CVE-2024-55591 and CVE-2025-24472 to plant superuser accounts before deploying ChaCha20+RSA-4096 encryption and appending .ENCRT. #DFIR_Radar https://t.co/98DUE3D73L

The Gentlemen ransomware hit 483 victims across 66 countries in under a year using infostealer credentials, AI tools, and a 90% affiliate cut. Internal chat leaks reveal their complete playbook. Key findings: • Initial access via FortiOS CVE-2024-55591, ZeroLogon, PetitPotam, and stolen OWA credentials from infostealer logs • 90% affiliate revenue split (vs typical 70-80%) targeting Tier 1-3 countries and Latin America over US 🇺🇸 targets • AI-assisted operations using "abliterated" Qwen models for coding and analyzing stolen data • Cross-referenced victims had live corporate logins in http://alerts.bar stealer index before appearing on leak sites • Copied Black Basta's leaked playbook as training manual rather than developing original TTPs Immediate actions: Treat infostealer infections as breaches requiring session revocation. Deploy hardware-backed auth to prevent cookie replay attacks that bypass MFA. #DFIR_Radar

Campaña de Gunra ataca dispositivos Fortinet explotando CVE-2024-55591 y CVE-2025-24472 para evadir MFA, elevar privilegios y acceder a redes empresariales. Mas información: https://www.ecucert.gob.ec/wp-content/uploads/2026/08/Al-2026-040-RANSOMWARE-GUNRA-EXPLOTA-VULNERABILIDADES-CRITICAS-EN-FORTINET.pdf #PorUnEcuadorCiberseguro @Arcotel_ec @CsirtCEDIA @CsirtEPN https://t.co/D2pZDm0uIB

Fortinet nigdy nie zawodzi… 😅 🔴 CVE-2024-55591 — 9.8 CRITICAL 🟠 CVE-2025-24472 — 8.1 HIGH Podatności w FortiOS/FortiProxy są wykorzystywane w atakach. Warto sprawdzić wersję i aktualizacje. #Fortinet #FortiGate #CVE #CyberSecurity https://t.co/nQESAuEON8

483 victims. 66 countries. Full encryption in under 24 hours. The Gentlemen kill chain: - CVE-2024-55591 FortiOS bypass (no creds) - GentleKiller BYOVD kills 48 vendors at kernel level - EtherRAT C2 via Ethereum contracts IOCs: https://decryptiondigest.com/blog/gentlemen-ransomware-etherrat-gentkiller-edr-bypass #Ransomware #BYOVD

GOLD SHERWOOD's "Gentlemen" RaaS hit 683 victims in under a year, with sub-24-hour dwell times, BYOVD EDR killers, and a repeatable affiliate playbook analysts can now map precisely. Key findings: - Initial access relied on stolen or brute-forced VPN credentials (CVE-2024-55591 cited in third-party reporting against FortiGate) with no MFA. Within the first hour, actors established redundant VPN sessions from multiple foreign IPs, then moved laterally via RDP to file servers and domain controllers using valid domain credentials. Privilege escalation came fast: net1 localgroup, net group "domain admins", and direct account password resets secured domain admin access before defenders could respond. - Tool staging landed in C:\PerfLogs, a low-scrutiny Windows directory. EDR killing used the custom GentleKiller suite (Watchdog, Javelin, G11 variants) plus Havoc and Xkpsm-Killer, all abusing vulnerable drivers (nogbc.sys, G11.sys, dmx.sys) via BYOVD. Windows Defender was neutered via Add-MpPreference exclusions and registry keys, and avkill.bat was pushed domain-wide via NETLOGON. - Exfiltration favored Rclone (5 of 15 incidents), with adaptive pivots to Restic and MinIO Client within a single intrusion. Ransom notes drop as README-GENTLEMEN.txt; Go-based locker binaries follow naming patterns like G_<ext>_windows_amd64.exe with --superfast/--ultrafast flags. #DFIR_Radar

🔓 Gunra explota fallos en dispositivos Fortinet FortiOS y FortiProxy conectados a internet (CVE-2024-55591 y CVE-2025-24472) para entrar y desplegar un modelo de doble extorsión: exfiltración y cifrado de datos a la vez.

Gunra ransomware, a Conti-derived RaaS now operating globally, exploits FortiOS/FortiProxy auth bypasses and VPN default creds to hit healthcare, government, critical manufacturing and more across six regions. Key findings: - Initial access via CVE-2024-55591 and CVE-2025-24472 (auth bypass in FortiOS/FortiProxy) plus default credentials on SSL-VPN appliances. Lateral movement uses Impacket over SMB and stolen session tokens. Persistence achieved by installing OpenSSH and creating backdoor VPN accounts with password-change bypass. - Credential theft via http://secretsdump.py against NTDS on domain controllers enabling pass-the-hash and pass-the-ticket. Actors also modified VDI portal files to bypass MFA and stole symmetric encryption keys from a Hiware access control server via SSH. - Gunra deletes logs and command history, operates 10 p.m. to 6 a.m., and uses IsDebuggerPresent to block analysis. The Windows encryptor uses FindFirstFileW/FindNextFileW to traverse all drives A through Z with no network indicators. - Critical decryption opportunity: Linux ELF variants as of March 2026 use a weak PRNG seeded with predictable system time. File timestamps can reconstruct encryption keys mathematically, making ransom payment unnecessary for Linux victims. Patch CVE-2024-55591 and CVE-2025-24472 immediately. For Linux victims, preserve file timestamps and attempt key reconstruction before paying. Audit VPN accounts for password-change bypass and review NTDS access logs. #DFIR_Radar

Initial access: CVE-2024-55591 and CVE-2025-24472, authentication bypass flaws in FortiOS and FortiProxy. Plus credential exposure in internet-facing VPN gateways and SSH access control weaknesses.

Gunra ransomware gang launched formal RaaS platform in January 2026 and is actively recruiting penetration testers and ethical hackers as initial access brokers for enterprise network access. US, South Korea agencies warn the group exploits CVE-2024-55591 and CVE-2025-24472 authentication bypass flaws in Fortinet's FortiOS and FortiProxy to gain admin access. The gang targets healthcare, financial services, government, and critical infrastructure globally using double-extortion tactics with 5-7 day deadlines before data publication. South Korean research exposed links between Gunra and North Korea's Lazarus Group suggesting shared techniques, tools, and infrastructure. The ransomware is based on leaked Conti source code with Linux variant supporting 100 parallel encryption threads and partial file encryption. CISA: "Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to US and international organizations." #Gunra #Ransomware #Fortinet #Lazarus #CISA

Gunra ransomware, a Conti-based RaaS also operating as "Golden Community," is exploiting CVE-2024-55591 and CVE-2025-24472 in FortiOS/FortiProxy to hit government and critical infrastructure. #DFIR_Radar https://t.co/WBeTSTKvdr

51 critical infrastructure orgs breached. Polish plant offline. Gunra ransomware exploits Fortinet CVE-2024-55591 (CVSS 9.6) -- no credentials needed. CISA AA26-222A issued. Patch FortiOS to 7.0.17 now. https://www.decryptiondigest.com/blog/gunra-ransomware-critical-infrastructure-fortinet-cve-2024-55591 #Ransomware #Fortinet

CVEs con explotación activa confirmada en junio: 🔴 CVE-2025-0282 · Ivanti VPN · RCE pre-auth (9.0) 🔴 CVE-2024-55591 · FortiOS · Auth bypass (9.8) 🟠 CVE-2025-21333 · Hyper-V · LPE (7.8) Tiempo medio de explotación desde publicación: <5 días. Nuestro equipo de ITE los tiene en el radar antes de que llegue el aviso.

Qilin's initial access playbook 👇 → phishing + spear phishing — AI-generated lures, near-impossible to spot → VPN exploitation — FortiGate CVE-2024-55591, CVE-2024-21762 → SAP NetWeaver zero-day — CVE-2025-31324 (CVSS 10.0) exploited before public disclosure → Check Point VPN — CVE-2026-50751 actively exploited this month → MSP supply chain — compromise one IT provider → push ransomware to all their clients one MSP breach in South Korea let them hit 25 financial firms in a single month. 🏦

Context that makes this worse 👇 → FortiGate is used by governments, hospitals, banks, and enterprises globally → The Gentlemen ransomware group already has 14,700 compromised FortiGate devices on standby from earlier campaigns → FortiOS CVE-2024-55591 (auth bypass) is still unpatched in thousands of orgs harvested credentials → initial access → ransomware. That's the full kill chain. and they already have the keys. 🔑

Their attack chain is clean and repeatable 👇 → initial access via CVE-2024-55591 (FortiOS auth bypass) or brute-forced VPN creds → they already have 14,700 compromised FortiGate devices on standby → privilege escalation → disable Defender → clear event logs → lateral movement via RDP, PsExec, WMI, PowerShell → deploy ransomware via Active Directory Group Policy — hits every machine simultaneously → double extortion: encrypt + threaten to leak stolen data 🔐

日本ランサムウェア Q1 2026の日本のランサムウェア被害は21件。The Gentlemen（6件）・Everest（4件）・Nightspire（3件）の3グループで被害全体の62%を占める。The GentlemenとNightspireはFortiGateの同一脆弱性（CVE-2024-55591）への集中攻撃が継続 https://www.ransomware.live/

CVE-2024-55591 &amp; CVE-2025-24472: Creating VPN tunnels through forticloud-sync service account, then going dormant for months to avoid detection. Attack linked to Matanbuchus 3.0.