Detecting Gunra Ransomware: VPN Exploitation, LSASS Dumping, and Double-Extortion Kill Chain

CISA advisory AA26-222A, published 10 August 2026, documents Gunra — a Conti-derived ransomware-as-a-service operation that gained initial access by exploiting CVE-2024-5559 and CVE-2025-24472 in internet-facing VPN and network edge appliances. Once inside, Gunra affiliates execute a kill chain directly inherited from Conti playbooks: LSASS credential dumping, SMB and RDP lateral movement, data staging and exfiltration, and finally mass encryption with volume shadow copy deletion.

This guide covers detection logic at each stage of that kill chain, with Sigma rules and Microsoft Sentinel KQL queries.

MITRE ATT&CK Mapping

Stage 1: VPN Initial Access — CVE Exploitation

Gunra actors scan for unpatched VPN devices exposed to the internet. CVE-2024-5559 and CVE-2025-24472 affect specific VPN appliance models and allow unauthenticated code execution or authentication bypass. Detection on the network edge focuses on anomalous authentication events and unexpected outbound connections immediately following.

Sigma Rule — Abnormal VPN Authentication Followed by Unusual Outbound Traffic

title: Gunra RaaS Initial Access — VPN Auth Anomaly with Lateral Outbound
id: a8d2e4f1-9c3b-4e7a-b162-3f8a5c2d9e01
status: experimental
description: Detects an authentication event from a VPN appliance IP followed within 5 minutes by SMB or RDP connections to internal hosts — indicative of Gunra or similar RaaS initial access pattern.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a
author: SOC Analyst Hub
date: 2026-08-16
tags:
  - attack.initial_access
  - attack.t1190
  - attack.credential_access
  - attack.t1078
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    IpAddress|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  vpn_source:
    # Adjust to match your VPN appliance IP range
    IpAddress|startswith: '10.0.200.'
  filter_expected:
    SubjectUserName|endswith: '$'
  condition: selection and vpn_source and not filter_expected
falsepositives:
  - Legitimate VPN user authentication to internal resources
  - IT administrators connecting via VPN to manage systems
level: medium

Microsoft Sentinel KQL — VPN Authentication from Unrecognised Source

// Detect first-seen authentication from VPN subnet IPs to internal hosts
SecurityEvent
| where EventID == 4624
| where LogonType == 3
| where IpAddress startswith "10.0.200." // Adjust to your VPN appliance range
| where not(Account endswith "$") // Exclude machine accounts
| summarize FirstSeen = min(TimeGenerated), Count = count()
    by Account, IpAddress, WorkstationName
| where FirstSeen > ago(24h)
| where Count < 3 // Low count suggests new/unusual access pattern
| project FirstSeen, Account, SourceIP = IpAddress, TargetHost = WorkstationName, Count
| order by FirstSeen asc

Stage 2: LSASS Credential Dumping

Gunra affiliates follow Conti procedure by dumping LSASS memory to harvest domain credentials for lateral movement. Common methods include MiniDump via comsvcs.dll, Task Manager, and Mimikatz variants. Detection targets Sysmon Event ID 10 (ProcessAccess) with LSASS as the target and suspicious GrantedAccess masks.

Sigma Rule — LSASS Memory Access with Suspicious GrantedAccess Mask

title: LSASS Memory Access — Credential Dumping Attempt
id: b9f3e5a2-0d4c-5f8b-c273-4g9b6d3e0f02
status: stable
description: Detects suspicious process access to LSASS targeting memory read operations. The GrantedAccess mask 0x1010 (PROCESS_VM_READ + PROCESS_QUERY_LIMITED_INFORMATION) is typical of many credential dumping tools.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a
  - https://attack.mitre.org/techniques/T1003/001/
author: SOC Analyst Hub
date: 2026-08-16
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  product: windows
  category: process_access
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x147a'
      - '0x143a'
  filter_legit:
    SourceImage|contains:
      - 'MsMpEng.exe'
      - 'AV.exe'
      - 'svchost.exe'
  condition: selection and not filter_legit
falsepositives:
  - Security products performing LSASS scanning (tune filter_legit for your environment)
  - Some EDR solutions access LSASS for monitoring
level: high

KQL — LSASS ProcessAccess via comsvcs.dll MiniDump

// Detect comsvcs.dll MiniDump technique — most common Conti-lineage LSASS dump method
DeviceProcessEvents
| where FileName == "rundll32.exe"
| where ProcessCommandLine has "comsvcs.dll" and ProcessCommandLine has "MiniDump"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

Stage 3: Lateral Movement via SMB and RDP

After obtaining domain credentials, Gunra affiliates move laterally via SMB (PsExec/wmiexec pattern) and RDP. Detection focuses on authentication events with administrative share access patterns and unusual RDP connection chains.

Sigma Rule — PsExec-Style SMB Lateral Movement

title: PsExec-Style Lateral Movement — SMB Admin Share Access
id: c0a4f6b3-1e5d-6g9c-d384-5h0c7e4f1g03
status: experimental
description: Detects PsExec-style lateral movement where PSEXESVC.exe or equivalent service binary is dropped to an admin share and executed remotely — a standard Conti and Gunra lateral movement technique.
author: SOC Analyst Hub
date: 2026-08-16
tags:
  - attack.lateral_movement
  - attack.t1021.002
logsource:
  product: windows
  service: security
detection:
  selection_share:
    EventID: 5145
    ShareName: '\\*\ADMIN$'
    RelativeTargetName|contains: 'PSEXESVC'
  selection_service:
    EventID: 7045
    ServiceName: 'PSEXESVC'
  condition: selection_share or selection_service
falsepositives:
  - Legitimate PsExec use by system administrators
  - Endpoint management tools using PSEXESVC
level: high

Stage 4: Pre-Encryption — Volume Shadow Copy Deletion

Before triggering encryption, Gunra deletes volume shadow copies to prevent recovery. This is consistently one of the most reliable pre-encryption signals for Conti-lineage ransomware.

Sigma Rule — VSS Deletion via vssadmin or wmic

title: Volume Shadow Copy Deletion — Pre-Ransomware Indicator
id: d1b5g7c4-2f6e-7h0d-e495-6i1d8f5g2h04
status: stable
description: Detects deletion of volume shadow copies via vssadmin or wmic — a consistent pre-encryption step in Conti, Gunra, and most RaaS operations.
author: SOC Analyst Hub
date: 2026-08-16
tags:
  - attack.impact
  - attack.t1490
logsource:
  product: windows
  category: process_creation
detection:
  vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  condition: vssadmin or wmic
falsepositives:
  - Backup software performing VSS management (rare for command-line invocation)
level: critical

KQL — Combined Pre-Encryption Staging Hunt

// Hunt for volume shadow deletion combined with ransom note indicators in a 15-minute window
let ShadowDeletion = DeviceProcessEvents
| where FileName in ("vssadmin.exe", "wmic.exe")
| where ProcessCommandLine has "delete" and ProcessCommandLine has_any ("shadows", "shadowcopy")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
| extend EventType = "ShadowDeletion";

let RansomIndicators = DeviceFileEvents
| where FileName has_any ("DECRYPT_FILES", "README_DECRYPT", "HOW_TO_DECRYPT", "GUNRA_README")
| project TimeGenerated, DeviceName, AccountName, FileName
| extend EventType = "RansomNote";

ShadowDeletion
| union RansomIndicators
| summarize Events = make_list(EventType), FirstEvent = min(TimeGenerated), LastEvent = max(TimeGenerated)
    by DeviceName, AccountName
| where array_length(Events) > 1
| where (LastEvent - FirstEvent) < 15m
| project DeviceName, AccountName, Events, FirstEvent, LastEvent
| order by FirstEvent asc

Tuning Recommendations

All Sigma rules should be tuned to your environment before promotion to production alerting:

• VPN authentication rules: Set the VPN appliance IP range to match your actual infrastructure. Allowlist expected IT admin accounts that regularly authenticate via VPN to internal systems.
• LSASS access rules: Enumerate all security products in your environment (EDR, AV, DLP) and add their process names to the filter block. Expect initial false positives and iterate.
• VSS deletion rules: Confirm whether any authorised backup processes invoke vssadmin from the command line. Most enterprise backup software uses VSS APIs rather than CLI — command-line invocation should be rare and always warrants investigation.

References

• CISA Advisory AA26-222A — Gunra Ransomware
• CISA — StopRansomware Gunra (PDF)
• MITRE ATT&CK T1003.001 — LSASS Memory
• MITRE ATT&CK T1490 — Inhibit System Recovery
• SafeBreach — Gunra AA26-222A Coverage