Podcast

Cyber Briefing (2026-08-16): Gunra ransomware neutralizes MFA via Fortinet; four wormable Windows DNS RCEs patched

Gunra ransomware rewrote VDI authentication on Fortinet MFA to bypass it silently while stealing symmetric encryption keys from Hiware servers; Microsoft patched four wormable DNS RCEs including CVSS 9.8 CVE-2026-62878.

Glenn Fryklund

Glenn Fryklund

— 4 min read
Share
Synthetic voice disclosure: This episode was produced with a synthetic voice. It is not read by a human narrator. If AI narration grates, consider muting during commutes and listening once with headphones; quality degrades gracefully after familiarization.

Episode Summary

  • Lead: A six-agency advisory (FBI/CISA/DC3/NSA/USSS/S.Korea's KNPA) exposes Gunra ransomware neutralizing MFA by rewriting VDI authentication logic on Fortinet infrastructure, and stealing symmetric encryption keys from Hiware access-control servers.
  • Follow-up: Microsoft patched four critical Windows DNS Server RCEs in August Patch Tuesday; CVE-2026-62878 (CVSS 9.8) is a stack-based buffer overflow called 'wormable' by ZDI. No confirmed exploitation yet, but perimeter-first patching is required.
  • Both stories reinforce the through-line: the trust layer is the new attack surface, and attackers are subverting identity/verification infrastructure rather than brute-forcing it.

Episode: daily-2026-08-16 · Type: Daily Briefing · Runtime: ~8.1 min · Hosts: Marcus & Priya · QA: all gates passed, publish decision PUBLISH (qa_report.json, orchestrator delivery verification, 2026-08-23T02:45Z)

Stories Covered

1. Gunra ransomware: Fortinet auth-bypass campaign that neutralizes MFA (Lead story)

Confirmed facts:

  • CISA AA26-222A cites CVE-2024-55591 and CVE-2025-24472 as the Fortinet flaws exploited by Gunra for initial access.
  • Gunra modifies VDI authentication server files so a specific OTP value always succeeds, neutralizing MFA without technically bypassing it.
  • Actors accessed Hiware access-control servers via SSH and stole the symmetric encryption keys used to encrypt stored enterprise passwords.
  • The advisory targets critical infrastructure: healthcare, financial services, government, manufacturing, transportation, utilities, academia, and media across the Americas, Europe, the Middle East, Africa, and Asia-Pacific.
  • AhnLab links Gunra's techniques to a state-sponsored threat actor targeting South Korea; the public advisory does not name an individual actor.

Analysis:

  • The pattern is consistent with prior trust-layer attacks (the SharePoint machine-key theft covered on Aug 12): steal or modify the trust material and patching does not evict you.
  • Six-agency coordination signals campaign maturity. An organized, state-linked threat rather than a single-crew incident.

Defender actions:

  • Audit Fortinet devices for FortiCloud SSO usage; disable it unless required. If needed, confirm patching against both CVE-2024-55591 and CVE-2025-24472.
  • Check VDI authentication server files for tampering, specifically whether the OTP validation logic has been modified from default behavior.
  • Review Hiware access-control server encryption-key rotation dates; this crew went after encrypted credential stores by design.
  • Assume the trust material is compromised until proven otherwise.

Uncertainties:

  • The scale of CVE-2024-55591 / CVE-2025-24472 exploitation by Gunra vs other affiliates using the same flaws is not quantified in the advisory.
  • Exact actor attribution: AhnLab suggests state ties to Korea but does not name a specific group; CISA says 'unclear where operators hail from'.

Sources:

2. Windows DNS Server: four potentially wormable RCEs (CVE-2026-62878) (Follow-up story)

Confirmed facts:

  • Microsoft patched four DNS Server RCE vulnerabilities in August Patch Tuesday: CVE-2026-62878 (9.8), CVE-2026-62817 (8.8), CVE-2026-62820 (8.1), CVE-2026-65789 (8.1).
  • CVE-2026-62878 is a stack-based buffer overflow, an unauthenticated remote RCE requiring no user interaction.
  • ZDI analyst Dustin Childs calls it 'a good ol' fashioned stack-based buffer overflow that ends up wormable'.
  • Microsoft rates exploitation as 'less likely'; ZDI pushes for fast patch deployment. Both can be right: a capability vs confirmation gap.
  • No confirmed in-the-wild exploitation as of this morning's reporting.

Analysis:

  • Placement matters more than CVSS: DNS servers sit on perimeters by design and are trusted by everything.
  • A wormable RCE in perimeter DNS is infrastructure-level, not endpoint-level.
  • If IT-to-OT segmentation is weak, this becomes a front door into OT. A pattern reinforced by prior VulnCheck data on OT-gateway exploit growth.

Defender actions:

  • Patch Windows DNS Server on every internet-facing and internal DNS box within 48 hours, today not next cycle.
  • If patching cannot happen in time, restrict inbound DNS to trusted resolvers only as an interim control.
  • Look in DNS logs for unusually large record sizes as a potential exploitation indicator.

Uncertainties:

  • Whether CVE-2026-62878 will be confirmed as exploited in the wild after the patch release; Microsoft says 'less likely' while ZDI says deploy fast. A gap between capability and confirmation.

Sources:

Terms Explained

MFA (Multi-Factor Authentication): Security requiring two or more verification steps. Here, the attackers don't defeat MFA; they make the server always accept a specific code, so users think 2FA works while attackers walk through.

VDI (Virtual Desktop Infrastructure): Remote desktop hosting where the authentication server decides which OTPs are valid. The decision layer was modified by the attackers to always accept a chosen code.

Wormable: A vulnerability that can spread autonomously from one system to another without user interaction. It is a capability, not confirmed spreading yet; it just means it could become self-propagating if exploited.

Uncertainties / Watch Items

  • Afd.sys Lazarus exploit fork proliferation: proof-of-concept forks keep proliferating; ransomware groups are expected to keep trying. The prior episode called 'days, not weeks' for this vector.
  • Exchange OWA cross-site scripting flaw (CVE-2026-42897): still unpatched three months after disclosure; the EEMS mitigation is the only countermeasure right now.
  • Container isolation attack vector (unionfs.sys tampering pattern): a general trend note. CVE details are unverifiable from the primary sources reviewed; watch for vendor advisories.

Episode ID: daily-2026-08-16 | Synthetic voice (supertonic-M3 / supertonic-F2) | Date: 2026-08-16 | Malwlab Cyber Briefing

Topics:

Read more