Fortinet on CuraSec

Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Act: Fortinet and Schneider Electric products are named as actively exploited entry points in a joint US/South Korea advisory; audit Fortinet appliances and OT-facing Schneider devices for unpatched vulnerabilities and apply vendor patches immediately.
SOC/IR — Act: Joint government advisory signals published TTPs and IOCs are available; run a Gunra hunt across network and endpoint telemetry now, prioritizing environments in healthcare, financial services, or government sectors given the stated targeting pattern.
Leader — Act: A US/South Korea joint advisory naming specific critical-infrastructure sectors—healthcare, financial, government—warrants same-week action: confirm whether Fortinet or Schneider Electric products are in your estate and brief leadership before this appears in industry news.

Tue, 21 Jul 2026 12:43:35 +0000

Engineer — Act: FortiSandbox is actively exploited per CISA KEV listing with a public PoC on GitHub; patch to the fixed version immediately and check for signs of compromise on any internet-facing FortiSandbox appliances.
SOC/IR — Act: KEV listing plus public PoC means exploitation is likely underway; hunt for anomalous outbound connections or new processes spawned from FortiSandbox hosts since the PoC publication date, and check edge appliance logs for unauthenticated command-injection attempts.
Leader — Plan: KEV-listed Fortinet RCE warrants confirming whether FortiSandbox is in the environment and requesting patch status from the infrastructure team; brief on remediation timeline if deployed, given the active exploitation signal.
Signals: CVE-2026-25089 — CISA KEV: listed, EPSS 0.36, public PoC on GitHub

Fri, 17 Jul 2026 12:06:10 +0000

Engineer — Act: CISA KEV listing with active exploitation means patch FortiSandbox to the vendor-fixed version immediately — treat this as a critical-priority change with a days-level window, not weeks.
SOC/IR — Act: Active exploitation of FortiSandbox warrants an assume-breach sweep on any FortiSandbox instances in the estate; hunt for anomalous outbound connections or config changes on those appliances since the vulnerability window opened.
Leader — Act: Confirm whether FortiSandbox is deployed anywhere in your environment, verify the patching timeline with your engineering team, and be prepared to brief leadership if you are a federal agency facing CISA’s Sunday deadline.