The Gunra Advisory Names Two CVEs, Both Fortinet. Half the Coverage Says Schneider Electric. It Is a Dropped Digit.
- Patrick Duggan
- 3 hours ago
- 5 min read
On August 10 the FBI, CISA, NSA and South Korea's National Police Agency published a joint #StopRansomware advisory on Gunra — AA26-222A. Gunra emerged in April 2025, is believed to derive from the leaked Conti source, has grown into a full ransomware-as-a-service operation with an affiliate programme, and has listed 51 victims across healthcare, financial services, critical manufacturing, transportation and logistics, government, and utilities.
It is a good advisory. It is also being reported with a vulnerability in it that is not there.
The dropped digit
Several outlets, including some very good ones, report that Gunra exploits "internet-facing Schneider Electric PowerLogic P5 (CVE-2024-5559)," and attribute that to AA26-222A.
We pulled the advisory and its machine-readable STIX bundle. The bundle contains exactly two vulnerability objects:
[CVE-2024-55591](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2024-55591) and [CVE-2025-24472](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2025-24472). Both are FortiOS/FortiProxy authentication bypasses, both CWE-288.
The word "Schneider" does not appear in the advisory. Not once.
Now look at the two identifiers side by side:
[CVE-2024-5559](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2024-5559) ← as reported [CVE-2024-55591](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2024-55591) ← as published by CISA
One digit. And the reason this produced a whole extra vendor rather than a dead link is that [CVE-2024-5559](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2024-5559) is a real CVE. NVD has it, published 2024-06-12: a Schneider Electric issue, CWE-327, use of a broken or risky cryptographic algorithm.
So somebody dropped a character, looked up the resulting identifier, found a genuine Schneider advisory, and wrote it into the story as a second exploited product. Then it syndicated.
Here is the detail that should have caught it. Read what CVE-2024-5559 actually requires:
"...an attacker gaining full control of the relay when a specially crafted reset token is entered into the front panel of the device."
The front panel. It is a physical-access bug on an electrical protection relay. It cannot be "internet-facing exploitation" by a ransomware crew, because exploiting it involves standing in front of the equipment pressing buttons.
We are not writing this to embarrass anyone — this is a transcription error, the most human kind, and the outlets carrying it do work we rely on and cite. We are writing it because the error has an operational cost. A defender who reads that headline goes looking for PowerLogic exposure that has nothing to do with Gunra, and in the process does not read far enough to find the thing that would actually help them, which is one string long and appears in the advisory's fifth table.
The detector nobody is printing
Exploiting CVE-2024-55591 and CVE-2025-24472 lets the actor abuse scheduled tasks on a vulnerable FortiOS firewall to create a new persistent user account with super-admin privileges and a hard-coded password.
That account is named `forticloud-sync`.
It looks like a Fortinet feature. It is not. If it exists on your firewall, someone else made it, and they made it with the highest privilege the device has.
That is the single highest-value line in the advisory: a free, instant, unambiguous check that requires no threat feed, no subscription and no malware analysis. Go and enumerate the admin accounts on your Fortinet devices right now. This is not something you have to be Gunra's target to benefit from checking — the account creation is a consequence of the CVEs, so anybody who exploited them may have left one.
Two more on-disk tells, both durable:
Gunra writes a static ransom note named `R3ADM3.txt` into every directory it encrypts, and appends `.ENCRT` to encrypted files (one July 2025 sample used .CRYPT). The binary contains logic to avoid re-encrypting .ENCRT files and to skip the notes — an efficiency choice by the developer that hands defenders two stable filename patterns. Before encryption, it uses WMI to delete volume shadow copies. Post-exploitation is Impacket — smbclient, psexec, secretsdump — and credential dumping from Windows systems.
Initial access is not only the Fortinet path: KNPA also observed exploitation of credential-exposure and SSH access-control weaknesses in internet-facing VPN gateways.
We ingested the indicators, and then we looked at their dates
We harvested AA26-222A's IOC set and pushed it into our feed under research-import-cisa-aa26-222a, verified by primary-key read-back: 26 of 30 records landed. The four failures are all email addresses, which our ingest schema does not accept. That is a real gap in our own schema and we would rather name it than quietly drop four indicators and call the batch complete.
Then we checked something the advisory itself flags, and which is worth stating plainly because almost nobody does:
Every network indicator in this advisory is stale.
Seventeen IP addresses. The five 23.239.119.x hosts were last seen November 6, 2025. The rest were last seen in December 2025. The clearnet leak-site mirror datapub[.]news operated June to July 2025. The advisory published August 10, 2026 — meaning its freshest network IOC was cold for eight months before the document existed.
CISA says so themselves, in the table: "Observed IP addresses/domains may be historical in nature. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking."
That disclaimer is correct and routinely ignored. So we did not ignore it. Every one of those IPs went into our feed at confidence 70, deliberately below the threshold at which an indicator flows into our automatic blocking path. They are searchable, correlatable and dated — and they will not silently block somebody's traffic on eight-month-old evidence. The file hashes went in at 90, because hashes do not go stale.
If your response to a joint advisory is to paste the IP table into a firewall, you have taken on false-positive risk in exchange for approximately no protection, on infrastructure the actor stopped using two quarters ago. The value in AA26-222A is the TTPs and `forticloud-sync`. It is not the IP list.
What to do before the weekend
Enumerate admin accounts on every Fortinet device you own and look for forticloud-sync or anything else you did not create. If you find one, you are in incident response, not patching.
Patch [CVE-2024-55591](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2024-55591) and [CVE-2025-24472](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2025-24472) if you somehow still have not — they are old, they are in KEV, and they are being used by a RaaS operation with an affiliate programme, which means the number of people using them only goes up.
Hunt the filenames. R3ADM3.txt and *.ENCRT across your file shares costs nothing and returns a definitive answer.
And check the CVE. Not as a criticism of anybody — as a habit. Identifiers are the one part of a security story that is machine-checkable in about ten seconds, and a dropped digit propagates further than a wrong sentence because it looks like data. We only caught this one because the vendor named in the coverage did not appear anywhere in the primary source, and that seemed worth ten seconds.
Primary source: joint advisory AA26-222A (FBI, CISA, NSA, Korean National Police Agency), published 2026-08-10, read together with its published STIX JSON bundle. CVE descriptions quoted from NVD. Our IOC ingest and the staleness analysis were run 2026-08-11. We hold no first-party telemetry on Gunra and are not claiming any; everything here is either from the advisory or is our own measurement of the advisory's contents.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=gunra-forticloud-sync-and-a-cve-typo
Comments