Gunra ransomware alerts show identity controls still fail at the edge

At a glance

What this is: This is SafeBreach’s analysis of CISA Alert AA26-222A, showing how Gunra ransomware chains edge-device compromise into credential theft, lateral movement, exfiltration, and recovery inhibition.

Why it matters: It matters because IAM, PAM, and NHI teams have to assume an exposed gateway can become an identity breach within minutes, not days, and validate controls accordingly.

👉 Read SafeBreach's analysis of Gunra ransomware and CISA Alert AA26-222A

Context

Gunra ransomware is a reminder that the first control failure is often not encryption itself, but the abuse of identity and remote access paths that let attackers move from an exposed device into internal systems. In this case, the primary security problem is not only malware execution, but how compromised administrative access, stolen credentials, and privileged remote services enable rapid escalation across the environment.

For identity teams, the important issue is the bridge between perimeter exposure and downstream privilege abuse. Gunra’s tradecraft includes NTDS dumping, pass-the-hash movement, and use of administrative accounts on VPN and firewall appliances, which makes it relevant to PAM, IAM, and NHI governance where service accounts, remote access, and recovery controls intersect.

Key questions

Q: What breaks when attackers can dump domain credentials and replay them laterally?

A: When attackers can dump domain credentials and replay them, the environment loses the distinction between an authenticated user and a trusted attacker. They can move through SMB, RDP, and administrative services using legitimate identity material, which defeats simple perimeter-only controls. The effective defence is to limit replayability, segment privileged paths, and remove standing administrative reuse.

Q: Why do exposed VPN and firewall appliances create ransomware blast radius problems?

A: Exposed VPN and firewall appliances often sit at the junction of remote access and administrative trust, so compromise there gives attackers both connectivity and identity leverage. Once they can alter appliance configuration or reuse admin sessions, they can pivot into internal systems with little friction. That makes appliance hardening and account governance inseparable.

Q: How should security teams limit ransomware spread through identity controls?

A: Security teams should reduce standing privilege, segment admin roles, and require task-scoped elevation for high-risk actions. They should also separate backup access from production access so a compromised account cannot encrypt data and destroy recovery paths in the same session. The goal is to make one stolen credential useful only for a narrow set of actions.

Q: Who is accountable when recovery controls fail during a double-extortion attack?

A: Accountability sits with the owners of identity, backup, infrastructure, and incident response controls because double extortion exploits the overlap between them. If recovery permissions, backup isolation, or log retention are not clearly assigned, attackers can erase evidence and reduce recovery options. Governance must define who owns each recovery identity and who reviews it.

Technical breakdown

How Gunra turns edge-device access into internal control loss

Gunra’s initial access pattern starts with internet-facing firewalls and VPN gateways, where known vulnerabilities and credential weaknesses create an entry point. Once inside, the campaign can create persistence on the appliance itself, including a malicious super-user account, and then reuse that foothold to reach internal services. This matters because the edge device is not just a network control. It is also an identity control plane, carrying administrative sessions and authentication trust that attackers can abuse after compromise.

Practical implication: treat remote access appliances as identity-critical assets and monitor them for account creation, config changes, and abnormal admin sessions.

Why credential access and pass-the-hash are the real escalation bridge

The advisory shows Gunra using NTDS credential dumping, session theft, password store abuse, and pass-the-hash or pass-the-ticket movement to reach privileged systems. That sequence turns a single foothold into domain-wide reach because Windows authentication still allows replay and reuse when secrets are exposed or poorly segmented. In identity terms, this is a failure of credential lifecycle control, privileged session containment, and resistance to lateral reuse after compromise.

Practical implication: isolate domain controller secrets, restrict administrative token reuse, and remove standing privilege from accounts that can move laterally.

How recovery inhibition and data theft amplify the impact

Gunra does not rely only on encryption. It deletes shadow copies, removes logs, archives data, and exfiltrates files before or alongside impact, which increases pressure to pay and reduces recovery options. The use of SharePoint, OneDrive, and shared storage also shows that cloud-connected collaboration systems can become exfiltration paths once identity is compromised. That makes this a broader governance problem than ransomware alone, because access rights determine how much data can be staged and stolen.

Practical implication: validate backup isolation, cloud data access boundaries, and logging preservation before an incident proves those controls are missing.

Threat narrative

Attacker objective: The objective is to gain privileged internal access, steal data, disrupt recovery, and force ransom payment through double extortion.

1. Entry occurs through exploited internet-facing firewall or VPN appliances, or through exposed credentials that let Gunra actors obtain unauthorized remote access.
2. Credential access follows through NTDS dumping, session cookie theft, password store abuse, and pass-the-hash reuse to harvest privileged identity material.
3. Escalation and movement occur when stolen credentials and administrative remote services are used to reach domain controllers, VDI, SMB shares, RDP sessions, and internal corporate systems.
4. Impact comes from data exfiltration, Shadow Copy deletion, log removal, and double-extortion encryption that limits recovery and increases ransom pressure.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity compromise is now the fastest route from edge exposure to ransomware impact. Gunra shows that a firewall or VPN compromise is not a network event in isolation. Once administrative access or reused credentials are available, the attacker is operating inside the identity plane, where privilege, session reuse, and off-boarded access gaps determine blast radius. For practitioners, the lesson is to govern edge appliances as identity-bearing systems, not just perimeter devices.

Standing administrative access is the governance assumption Gunra exploits. The campaign repeatedly benefits from accounts, sessions, and appliance roles that persist longer than they should. That is the classic failure mode for PAM and NHI programmes: if privileged access remains available after the business need ends, attackers inherit the same access path. Practitioners should read this as a control-gap signal around lifecycle, lockout, and reuse rather than a simple malware problem.

Credential replay is the named concept this advisory sharpens: the reuse of trusted identity material after compromise. Pass-the-hash, pass-the-ticket, session theft, and password-store extraction all depend on the same trust failure. When identity evidence can be replayed across services, segmentation alone cannot contain the attack. Practitioners need to treat replayable secrets as an exposure category with its own governance, not as a generic authentication issue.

Ransomware resilience now depends on the identity of backup and recovery paths. Gunra’s Shadow Copy deletion and log wiping show that attackers understand recovery control points and target them deliberately. That means backup accounts, DR access, and administrative recovery tooling need the same scrutiny as production identities. For security leaders, the control question is whether recovery identities are separated, limited, and monitored tightly enough to survive compromise.

SafeBreach’s validation focus is directionally right, but the harder problem is control composition. Simulating NTDS dumping or lateral movement is useful only if the programme also checks whether identity boundaries, privileged session design, and recovery permissions fail together. That is where ransomware defence increasingly sits: not in one control, but in whether the whole identity stack resists chained abuse. Practitioners should evaluate control interaction, not just individual detections.

From our research:

• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
• From our research: Enterprieses that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
• From our research: Review identity lifecycle and standing privilege patterns through Ultimate Guide to NHIs , Static vs Dynamic Secrets before attackers turn a single credential into lateral movement.

What this signals

Credential replay is becoming the decisive ransomware control gap. When attackers can reuse hashes, tickets, or session material, the environment behaves as though every exposed identity is a network route. That is why governance over privileged accounts, remote access appliances, and recovery paths needs to be treated as one control surface, not three separate programmes. For readers, the operational signal is clear: measure how far one stolen identity can travel before containment breaks.

The practical response is to tighten segmentation around administrative paths and verify that backup, DR, and collaboration systems are not reachable through the same trust chain as production identities. Where the identity plane is weak, ransomware behaviour becomes a governance failure rather than a detection failure. Teams that can prove recovery access is separated and monitored will reduce both blast radius and ransom leverage.

For practitioners

• Harden edge-device identities Inventory firewall and VPN appliance accounts, disable unused administrative identities, and alert on new super-user creation such as unexpected device-local admin accounts.
• Break credential replay paths Prioritise domain controller protection, Kerberos and NTLM hardening, and rapid revocation of hashes, tickets, and stored passwords that can be reused laterally.
• Separate recovery access from production access Place backup deletion, shadow copy management, and disaster recovery permissions under distinct accounts with tight monitoring and no standing elevation.
• Detect activity in the attacker’s operating window Baseline privileged logons, reconnaissance, and account changes between 10:00 p.m. and 06:00 a.m., then escalate anomalies from remote access appliances and domain controllers.
• Validate exfiltration paths through collaboration platforms Review whether SharePoint, OneDrive, and file-transfer tools can move data out of the environment after identity compromise, and test those controls in simulation.

Key takeaways

• Gunra demonstrates that ransomware impact often begins as an identity governance failure at the edge.
• The campaign’s use of credential dumping, pass-the-hash, and recovery inhibition shows how one compromise can become enterprise-wide disruption.
• Practitioners should validate privileged access separation, replay resistance, and recovery-path isolation before an attacker does it for them.

Key terms

• Credential replay: Credential replay is the reuse of stolen authentication material to impersonate a legitimate user or system. In human identity programmes, replay risk grows when passwords, OTPs, or weak recovery flows can be captured and used from a separate device or session.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Recovery inhibition: Recovery inhibition is any attacker action that reduces the organisation’s ability to restore systems or data after compromise. It includes deleting shadow copies, destroying backups, wiping logs, or altering recovery accounts so that containment and restoration become slower, harder, or impossible.
• Pass-the-Hash: An authentication abuse technique where an attacker uses a stolen password hash instead of the cleartext password. It matters in Windows environments because cached credentials can sometimes be enough to gain access, turning one compromised host into a broader lateral movement opportunity.

What's in the full article

SafeBreach's full analysis covers the operational detail this post intentionally leaves for the source:

• ATT&CK-mapped simulation IDs for NTDS dumping, pass-the-hash, shadow copy deletion, and SharePoint exfiltration.
• CISA advisory IOC handling guidance, including how to use the supplied indicators without overblocking historical infrastructure.
• Detailed mitigation steps for Fortinet compromise indicators, recovery inhibition, and off-hours privileged activity.
• Platform workflow guidance for running the AA26-222A scenarios and filtering related attack playbooks.

👉 The full SafeBreach post covers ATT&CK mappings, IOC handling, and simulation coverage for Gunra activity.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives practitioners a structured way to manage identity risk where access, privilege, and lifecycle controls intersect.