Gunra Ransomware: CISA and FBI Warn of Conti-Derived RaaS Targeting Global Critical Infrastructure

CISA, the FBI, the NSA, and South Korea’s National Police Agency have issued a joint advisory warning that the Gunra ransomware gang is actively targeting government agencies, critical infrastructure, and healthcare organizations worldwide. Gunra first appeared in April 2025 and has since evolved into a full ransomware-as-a-service (RaaS) platform that recruits penetration testers and ethical hackers as initial access brokers.

What Happened: Gunra Ransomware Expands to RaaS and Targets Global Infrastructure

Gunra is a double-extortion ransomware variant built from the leaked Conti source code. The FBI first observed Gunra in April 2025. Since then, the group has grown rapidly. In January 2026, Gunra launched a formal RaaS affiliate program on dark web forums. Affiliates receive a management panel, a configurable ransomware builder, cross-platform payloads, and structured documentation.

The FBI also observed Gunra operating under the alias “Golden Community” to support this expansion. Furthermore, the group has actively recruited penetration testers and ethical hackers to serve as initial access brokers. These brokers receive a share of ransom profits in exchange for enterprise network access.

Victims span multiple sectors across the Americas, Europe, the Middle East, Africa, and Asia-Pacific. Targeted sectors include healthcare, financial services, critical manufacturing, transportation, government facilities, utilities, academia, retail, and professional services.

Technical Details of the Gunra Ransomware Attack Chain

Gunra actors obtain initial access primarily by exploiting known vulnerabilities in internet-facing devices. The FBI observed attacks leveraging two critical Fortinet authentication bypass flaws.

• CVE-2024-55591: Authentication bypass in FortiOS and FortiProxy
• CVE-2025-24472: Authentication bypass in FortiOS and FortiProxy

In addition, South Korean authorities observed Gunra actors exploiting credential-exposure and SSH access control flaws in internet-facing VPN gateways. These vulnerabilities allow unauthorized remote access without valid credentials.

Once inside, Gunra uses a multi-threaded Windows encryptor that leverages ChaCha20 and RSA-4096 encryption. The binary uses FindFirstFileW and FindNextFileW API calls to enumerate all drive letters from A through Z. Consequently, it achieves comprehensive file system traversal before encryption begins.

The ransomware filters out system directories and executable files. It targets user data such as documents, databases, images, and archives. Moreover, the binary includes anti-debugging logic via the IsDebuggerPresent API to hinder reverse engineering.

Gunra actors move laterally using Impacket libraries including psexec.py, smbclient.py, and secretsdump.py. They extract password hashes from NTDS files for pass-the-hash attacks. In at least one case, actors manipulated an SSL-VPN appliance to capture credentials and session cookies. They then hijacked sessions to impersonate legitimate users.

For one victim, Gunra actors modified authentication processing files on a VDI portal server. This allowed them to bypass multi-factor authentication using a specific one-time password value designated by the attackers.

Business and Operational Impact

The Gunra ransomware campaign poses severe risks to organizations across every critical infrastructure sector. The double-extortion model means victims face both encryption and data publication threats.

• Data exfiltration: Gunra actors steal business-critical documents, databases, PII, and internal emails before encryption
• Volume of theft: The FBI observed exfiltration volumes reaching tens of terabytes for a single victim
• Cross-platform targeting: A Linux variant introduced in mid-2025 expanded Gunra’s reach beyond Windows environments
• Service disruption: Encrypted systems include database servers, NAS devices, and virtual desktops
• Compliance exposure: Healthcare and government victims face HIPAA, GDPR, and CMMC regulatory consequences
• Geographic breadth: Victims are located across six continents with no sector immune

In one documented case, Gunra actors pivoted from an internet-facing workstation to a VDI authentication server, an internal Active Directory server, and virtual desktops assigned to IT personnel. This demonstrates the group’s ability to navigate complex enterprise networks quickly.

Mitigation and Recommendations

The authoring agencies urge organizations to implement layered defenses against Gunra ransomware. Patching, segmentation, and offline backups are the three pillars of an effective response.

Immediate Actions for Defenders

1. Patch internet-facing systems immediately. Prioritize Fortinet firewalls, VPN gateways, and RDP-exposed infrastructure. Apply all security updates for CVE-2024-55591 and CVE-2025-24472 without delay
2. Implement offline immutable backups. Store backups in a physically separate, segmented location. Test restore procedures regularly to ensure recoverability without ransom payment
3. Segment networks to restrict lateral movement. Isolate critical systems from general user networks. Limit SMB and RDP traffic to required paths only
4. Audit VPN and SSL-VPN configurations. Remove default credentials. Enable account lockout controls. Monitor for unauthorized administrative access
5. Monitor for Impacket activity. Alert on psexec.py, smbclient.py, and secretsdump.py usage in your environment
6. Review SharePoint and OneDrive access logs. Gunra actors have used main.exe to exfiltrate data from Microsoft cloud services
7. Hunt for session hijacking indicators. Look for unusual session cookies, MFA bypass attempts, and authentication anomalies

Detection Guidance

The FBI and CISA have published STIX-formatted indicators of compromise. Download the AA26-222A STIX XML and JSON files from CISA’s advisory page. These IOCs cover file hashes, network indicators, and behavioral signatures observed in confirmed Gunra incidents.

Bottom line: Gunra is a mature, well-resourced ransomware operation with nation-state-linked affiliations, cross-platform capabilities, and a structured RaaS business model. Organizations must treat this threat with urgency. Patch internet-facing systems now, segment your networks, and verify that your backup strategy can withstand a double-extortion attack.

Incident Summary

Threat Name:	Gunra Ransomware (also operates as “Golden Community”)
First Observed:	April 2025
RaaS Launch:	January 2026
Encryption:	ChaCha20 + RSA-4096
Initial Access CVEs:	CVE-2024-55591, CVE-2025-24472 (Fortinet auth bypass)
Target Sectors:	Healthcare, financial, manufacturing, transportation, government, utilities, academia, retail
Geographic Scope:	Americas, Europe, Middle East, Africa, Asia-Pacific
Affiliation:	Linked to Lazarus Group by AhnLab (North Korean state-backed)
Advisory:	CISA AA26-222A, published August 10, 2026

References

1. CISA, FBI, NSA, DC3, USSS, and Republic of Korea National Police Agency, “#StopRansomware: Gunra Ransomware,” Advisory AA26-222A, August 10, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a, accessed August 11, 2026
2. BleepingComputer, “US and South Korea warn of Gunra ransomware targeting govt agencies,” August 11, 2026, https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/, accessed August 11, 2026
3. AhnLab, “Operation Double Barrel,” July 30, 2026, https://asec.ahnlab.com/en/94696/, accessed August 11, 2026