Cybersecurity and intelligence agencies from South Korea and the United States have issued a joint warning on Gunra, an encryption-based ransomware operation actively targeting critical infrastructure worldwide. Confirmed victimology spans healthcare and public health, financial services, government services and facilities, and professional and nonprofit services — a target profile that maps almost perfectly onto the sectors least able to tolerate downtime.
What elevates Gunra from background ransomware noise to an operational priority is its initial access vector: exploitation of known flaws in Fortinet and Schneider Electric products. Fortinet appliances sit at the network edge — VPN concentrators, firewalls, and secure gateways — while Schneider Electric hardware occupies operational technology (OT) environments, including power management, building automation, and industrial control contexts. An intrusion chain that starts at the edge and pivots into OT-adjacent infrastructure is precisely the scenario critical infrastructure defenders have been war-gaming for years.
This post breaks down the threat from a defensive standpoint: how the attack chain is likely structured, what to hunt for on your endpoints and network telemetry, and the concrete hardening steps you should execute this week — not after your next patch cycle.
Technical Analysis
Threat Overview
Gunra is described in the joint advisory as another variant in the ongoing trend of ransomware families that pair encryption-based extortion with exploitation of perimeter and industrial-adjacent devices for initial access. While the advisory does not assign the activity to a single nation-state, the coordinated release by South Korean and U.S. intelligence and cybersecurity agencies signals a campaign operating at sufficient scale and impact to warrant government-level attribution of victim impact.
Affected Products and Attack Surface
Based on the reporting, two product ecosystems are in the blast radius:
- Fortinet — FortiGate firewalls, FortiProxy, and related edge appliances. Historically and currently, Fortinet edge devices are among the most heavily exploited targets in ransomware operations because they are internet-facing by design, hold VPN credentials and session material, and are frequently under-patched due to change-control friction on perimeter devices.
- Schneider Electric — industrial and infrastructure management products, including power monitoring, building management systems (BMS), and ICS-adjacent platforms. These systems are often reachable from IT networks and notoriously lag on patching due to uptime requirements and vendor qualification cycles.
Because the advisory does not enumerate specific CVE identifiers in the public summary, defenders should treat all currently known, unpatched vulnerabilities in internet-exposed Fortinet and Schneider Electric products as potentially in scope and prioritize per CISA's Known Exploited Vulnerabilities (KEV) catalog. Do not wait for a CVE mapping to act — the exploitation is confirmed in the wild against live targets.
Likely Attack Chain (Defender's View)
Based on the victimology and entry points described, the attack chain defenders should assume and hunt against is:
- Initial Access (TA0001) — Exploitation of a public-facing Fortinet appliance (SSL-VPN / management interface) or an exposed Schneider Electric web-facing service. This yields either a shell on the appliance, credential material, or an authenticated foothold.
- Credential Access & Discovery (TA0006 / TA0007) — Harvesting of VPN credentials, cached domain credentials, and configuration files from the compromised edge device; reconnaissance of internal segments reachable from the appliance, including OT-adjacent VLANs.
- Lateral Movement (TA0008) — Use of legitimate remote access protocols (RDP, SMB, WinRM) with harvested credentials. Ransomware operators overwhelmingly favor living-off-the-land tooling over custom implants at this stage.
- Defense Evasion (TA0005) — Disabling or uninstalling EDR/AV, deleting Volume Shadow Copies to destroy recovery options, and clearing event logs.
- Impact (TA0040) — Mass encryption via the Gunra payload, typically staged through
PsExec-style remote execution, Group Policy distribution, or scheduled tasks pushed from a compromised management host.
Exploitation Status
- Active exploitation: confirmed. This is not a theoretical or proof-of-concept scenario — government agencies from two countries have jointly warned of ongoing attacks against named critical infrastructure sectors.
- KEV status: Defenders should cross-reference their Fortinet and Schneider Electric exposure against the current CISA KEV catalog and treat any listed entries as emergency-change priorities.
Detection & Response
The detections below target the behaviors this class of campaign produces — edge-device exploitation artifacts, post-compromise credential theft, ransomware staging, and destructive pre-encryption actions — because those are observable regardless of which specific CVE is being used for entry.
SIGMA Rules
---
title: Ransomware Shadow Copy Deletion via vssadmin or WMIC
id: 3f8a1c92-7d4e-4b6a-9e21-5c0d2f8a6b31
status: experimental
description: Detects deletion of Volume Shadow Copies, a near-universal pre-encryption behavior in ransomware operations including Gunra, executed via vssadmin, wmic, or diskshadow.
references:
- https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/08/10
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\vssadmin.exe'
- '\wmic.exe'
- '\diskshadow.exe'
selection_cli:
CommandLine|contains:
- 'delete shadows'
- 'shadowcopy delete'
- 'delete catalog'
- 'resize shadowstorage'
condition: selection_img and selection_cli
falsepositives:
- Legitimate backup administrators resizing shadow storage during maintenance windows
- Some backup software reconfiguring VSS (verify against change tickets)
level: critical
---
title: BCDEdit Boot Recovery and Safe Mode Tampering
id: 6b2e9d47-1a8f-4c53-b794-2d6e8a3c5f09
status: experimental
description: Detects modification of boot configuration to disable recovery options or force safe-mode boot, a technique used by ransomware operators to inhibit recovery and evade EDR drivers.
references:
- https://attack.mitre.org/techniques/T1562.001/
- https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/08/10
tags:
- attack.defense_evasion
- attack.impact
- attack.t1562.001
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\bcdedit.exe'
CommandLine|contains:
- 'recoveryenabled no'
- 'bootstatuspolicy ignoreallfailures'
- 'safeboot'
falsepositives:
- Rare administrative recovery configuration during OS deployment
level: high
---
title: Security Tool Discovery and Disablement Commands
id: 9d4c7e15-3b6a-48f2-a1c8-7e5d9b2a4f63
status: experimental
description: Detects attempts to enumerate or terminate security products via net, sc, taskkill, or netsh commands commonly used by ransomware operators before payload deployment.
references:
- https://attack.mitre.org/techniques/T1562.001/
- https://attack.mitre.org/techniques/T1518.001/
author: Security Arsenal
date: 2026/08/10
tags:
- attack.defense_evasion
- attack.discovery
- attack.t1562.001
logsource:
category: process_creation
product: windows
detection:
selection_stop:
Image|endswith:
- '\net.exe'
- '\net1.exe'
- '\sc.exe'
- '\taskkill.exe'
CommandLine|contains:
- 'stop'
- 'delete'
- '/f /im'
- 'config'
- 'disabled'
selection_target:
CommandLine|contains:
- 'defender'
- 'sentinel'
- 'crowdstrike'
- 'falcon'
- 'sophos'
- 'carbonblack'
- 'cb'
- 'cybereason'
- 'mssense'
- 'msmpeng'
- 'avp'
- 'veeam'
- 'backup'
- 'sql'
condition: selection_stop and selection_target
falsepositives:
- Authorized EDR administration or software removal by IT with change record
level: high
KQL (Microsoft Sentinel / Defender)
The first query hunts pre-encryption behaviors across Windows endpoints in Defender XDR. The second hunts for Fortinet exploitation artifacts from Syslog/CEF-ingested firewall telemetry — specifically administrative logins and configuration changes from unusual sources, which frequently follow edge-device compromise.
// Hunt 1: Pre-encryption staging behaviors correlated on a single host within 1 hour
let window = 1h;
let shadowDelete = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy delete")
or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
| project DeviceName, TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessAccountName;
let secToolKill = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("net.exe", "net1.exe", "sc.exe", "taskkill.exe")
| where ProcessCommandLine has_any ("defender", "sentinel", "crowdstrike", "falcon", "sophos", "carbonblack", "veeam", "msmpeng")
| project DeviceName, TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessAccountName;
shadowDelete
| join kind=inner secToolKill on DeviceName
| where abs(datetime_diff('minute', TimeGenerated, TimeGenerated1)) <= 60
| project DeviceName, ShadowDeleteTime=TimeGenerated, ShadowDeleteCmd=ProcessCommandLine, KillTime=TimeGenerated1, KillCmd=ProcessCommandLine1, Account=InitiatingProcessAccountName
| sort by ShadowDeleteTime desc;
// Hunt 2: Fortinet admin logins and config changes from untrusted sources (CEF/Syslog ingestion)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor =~ "Fortinet"
| where DeviceEventClassID in ("32001", "32002") or Message has_any ("login", "config", "admin")
| where Activity has_any ("login", "edit", "config")
| where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172.16."
| summarize LoginCount=count(), Actions=make_set(Activity, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationHostName, SourceUserName
| order by LastSeen desc;
// Hunt 3: Schneider Electric / OT-adjacent web service exploitation attempts (IIS and web logs via Syslog)
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("ecoStruxure", "schneider", "powerlogic", "struxureware")
or (SyslogMessage has_any ("../", "%2e%2e", "cmd.exe", "/bin/sh", "powershell") and SyslogMessage has_any ("GET", "POST"))
| project TimeGenerated, Computer, HostIP, SyslogMessage
| order by TimeGenerated desc;
Velociraptor VQL
This hunt sweeps endpoints for the destructive command artifacts and mass-encryption precursors that characterize Gunra-style intrusions — shadow copy deletion, boot tampering, and suspicious child processes of remote execution services used for payload distribution.
-- Hunt for ransomware staging artifacts: shadow deletion, boot tampering, and remote-exec children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
(Name =~ '(?i)vssadmin|wmic|diskshadow' AND CommandLine =~ '(?i)delete shadows|shadowcopy delete|delete catalog|resize shadowstorage')
OR (Name =~ '(?i)bcdedit' AND CommandLine =~ '(?i)recoveryenabled no|ignoreallfailures|safeboot')
OR (Name =~ '(?i)sc|net|net1|taskkill' AND CommandLine =~ '(?i)defender|sentinel|crowdstrike|falcon|sophos|veeam|backup')
OR (Parent.Name =~ '(?i)psexesvc|remcom|paexec|wmiprvse' AND Name =~ '(?i)cmd|powershell|wscript|cscript|rundll32')
)
Verification & Hardening Script
Run this on Windows servers and management hosts to verify recovery options are intact (attackers frequently disable them before encryption — a disabled recovery setting is itself a compromise indicator), confirm VSS health, and check for unauthorized local administrators that often follow credential harvesting.
# Gunra-style ransomware readiness check — run elevated on servers and management hosts
$report = @()
# 1. Verify boot recovery is ENABLED (disabled = strong compromise indicator)
$bcd = bcdedit /enum {current} 2>&1 | Out-String
$recoveryDisabled = $bcd -match 'recoveryenabled\s+No'
$report += [pscustomobject]@{ Check='Boot Recovery Enabled'; Status = if ($recoveryDisabled) {'FAIL - POSSIBLE COMPROMISE'} else {'OK'} }
# 2. Check VSS service state and existing shadow copies
$vss = Get-Service VSS -ErrorAction SilentlyContinue
$shadows = (vssadmin list shadows 2>&1 | Out-String) -match 'Shadow Copy Volume'
$report += [pscustomobject]@{ Check='VSS Service Present'; Status = if ($vss) {"OK ($($vss.Status))"} else {'MISSING'} }
$report += [pscustomobject]@{ Check='Shadow Copies Exist'; Status = if ($shadows) {'OK'} else {'NONE - verify backup strategy'} }
# 3. Flag recent shadow deletions in System log (VSS source, event 33 or volsnap)
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='VolSnap'} -MaxEvents 50 -ErrorAction SilentlyContinue
$report += [pscustomobject]@{ Check='Recent VolSnap Deletion Events'; Status = if ($vssEvents) {"REVIEW ($($vssEvents.Count) events)"} else {'OK'} }
# 4. Enumerate local admins and flag accounts created in last 30 days
$cutoff = (Get-Date).AddDays(-30)
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
foreach ($a in $admins) {
$acct = Get-LocalUser -Name ($a.Name -split '\\')[-1] -ErrorAction SilentlyContinue
if ($acct -and $acct.PasswordLastSet -gt $cutoff -and -not $acct.Enabled) { continue }
}
$report += [pscustomobject]@{ Check='Local Admin Count'; Status = "$($admins.Count) members - validate each is authorized" }
# 5. Confirm Defender tamper protection and real-time protection are on
$mp = Get-MpComputerStatus -ErrorAction SilentlyContinue
if ($mp) {
$report += [pscustomobject]@{ Check='Defender Real-Time Protection'; Status = if ($mp.RealTimeProtectionEnabled) {'OK'} else {'FAIL - POSSIBLE TAMPERING'} }
$report += [pscustomobject]@{ Check='Defender Tamper Protection'; Status = if ($mp.IsTamperProtected) {'OK'} else {'FAIL'} }
}
$report | Format-Table -AutoSize
Remediation
Prioritized actions, ordered by time-to-risk-reduction:
- Patch Fortinet edge devices immediately. Inventory every internet-facing FortiGate, FortiProxy, and FortiManager instance. Apply the latest FortiOS/FortiProxy firmware per Fortinet's PSIRT advisories at fortiguard.com/psirt. Cross-check your firmware versions against the CISA KEV catalog — any KEV-listed Fortinet CVE on an internet-facing device is an emergency change, not a scheduled one. After patching, assume pre-patch compromise: rotate all VPN user and admin credentials, revoke active sessions, and audit local admin accounts on the appliance for unauthorized additions.
- Patch and segment Schneider Electric systems. Apply current security updates per Schneider Electric's security notifications at se.com/ww/en/work/support/cybersecurity. Where patching requires vendor qualification and cannot be immediate, enforce strict network segmentation: OT and building-management systems should not be directly reachable from general IT user VLANs, and absolutely not from the internet.
- Eliminate direct internet exposure of management interfaces. Fortinet admin GUI, Schneider Electric web consoles, and any ICS management interface must never answer on public IPs. Restrict to a hardened management VLAN reachable only via MFA-authenticated jump hosts.
- Enforce phishing-resistant MFA on all remote access. Credential theft from edge devices only pays off if stolen creds work elsewhere. MFA on VPN, RDP gateways, and privileged accounts breaks the lateral movement chain.
- Protect recovery capability. Enable tamper protection, restrict
vssadmin/bcdedit/wbadminexecution to a dedicated admin tier via AppLocker or WDAC, and maintain offline or immutable backups (object-lock, air-gapped, or WORM storage) tested for actual restoration. - Deploy the detections above and validate them in a purple-team exercise. A Sigma rule that has never fired in testing is a hypothesis, not a control.
- Establish an IR retainer and rehearse. Healthcare, financial, and government targets in this campaign experienced operational disruption. Tabletop a ransomware scenario that begins with a compromised edge appliance — your runbook must cover edge-device forensics, credential rotation at scale, and OT isolation decisions.
Key Takeaways
- Gunra's exploitation of Fortinet and Schneider Electric products confirms what the telemetry has shown for years: the edge appliance is the new phishing email. Patch velocity on perimeter devices is now a top-three ransomware control.
- Patch alone is insufficient — assume pre-patch compromise on any device that was internet-facing while vulnerable, and rotate credentials accordingly.
- The destructive pre-encryption behaviors (shadow deletion, boot tampering, security tool termination) are your highest-fidelity detection opportunity. They are loud, rare in legitimate operations, and precede impact.
- IT/OT segmentation is not a compliance checkbox — in this campaign's target set, it is the difference between an IT outage and a patient-safety or public-safety event.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.