Critical 9.8
KEV + Ransomware
CVE-2024-55591
Lazarus Group and Gunra Ransomware Exploit Korean Financial Software
Vendor / product: Korean financial security software
Event date: 2025-04-01
Public PoC: Yes
First tracked by RiskWire: 2026-07-28
CISA KEV catalog
Added to KEV
Federal remediation due
2025-01-21 (607 days overdue)
Ransomware campaign use
Known
CISA description
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Named threat actors
Lazarus GroupGunra
Sources & citations (22)
- North Korea's Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn therecord.media · 2026-07-30
- CISA, FBI Warn Gunra Ransomware Targets Critical Infrastructure meritalk.com · 2026-08-10
- S. Korea, U.S. issue joint advisory on 'Gunra' ransomware attacks n.news.naver.com · 2026-08-11
- North Korea's APT Capabilities Are No Longer State-Exclusive bankinfosecurity.com · 2026-07-31
- CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors cisa.gov · 2026-08-10
- Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks thehackernews.com · 2026-08-11
- Gunra Ransomware Exploits Fortinet VPN Flaws to Bypass MFA and Steal Enterprise Data cybersecuritynews.com · 2026-08-10
- US and South Korea warn of Gunra ransomware targeting govt agencies bleepingcomputer.com · 2026-08-11
- FBI warns Gunra ransomware targets critical sectors and governments cyberinsider.com · 2026-08-11
- CISA Urges Organizations to Patch Exposed VPNs and Segment Networks Against Gunra Ransomware gbhackers.com · 2026-08-11
- South Korea, US warn of Gunra ransomware targeting healthcare, finance and critical infrastructure firstpost.com · 2026-08-11
- Warning issued over Gunra ransomware gang as attacks ramp up globally itpro.com · 2026-08-11
- Korea, U.S. Team Up Against GUNRA Ransomware Gang Targeting Firms en.sedaily.com · 2026-08-11
- South Korea, U.S. warn of Gunra ransomware attacks targeting critical infrastructure koreajoongangdaily.com · 2026-08-11
- Korean police warn of Gunra ransomware spread, issue joint South Korea-U.S. cybersecurity advisory digitaltoday.co.kr · 2026-08-11
- CISA Advisory: #StopRansomware: Gunra Ransomware databreaches.net · 2026-08-10
- Korea, FBI warn of Gunra ransomware and urge reporting over negotiation biz.chosun.com · 2026-08-11
- CISA, FBI, and Partners Release Joint Cybersecurity Advisory on Gunra Ransomware content.govdelivery.com · 2026-08-10
- U.S., South Korean government agencies caution to be on lookout for Gunra ransomware gang cyberscoop.com · 2026-08-10
- #StopRansomware: Gunra Ransomware cisa.gov · 2026-08-10
+2 more sources
References
See CVE-2024-55591 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →