Gunra Ransomware: FBI and CISA Warn of Attacks on Critical Infrastructure

Six US federal agencies and South Korea’s National Police Agency don’t issue joint advisories because they’re bored on a Friday. When the FBI, CISA, NSA, DC3, the Secret Service and the KNPA all put their names on the same document, published on August 10, 2026 under the #StopRansomware programme, the subject deserves attention. And the subject is Gunra, a ransomware operation that has gone from zero to full-blown ransomware-as-a-service platform in barely a year while hitting critical infrastructure across multiple continents along the way.

This is not a theoretical threat: Gunra has confirmed victims in healthcare, financial services, government and manufacturing, with ransom demands routinely north of ten million dollars.

Where Gunra comes from

Gunra showed up in April 2025, and here’s the part that should sound familiar to anyone who’s been following ransomware for the past few years: it’s built on the Conti source code, the same codebase that was leaked publicly in February 2022 by a Ukrainian security researcher. That leak was supposed to be a blow against Conti, but instead it handed a blueprint to every aspiring ransomware operator on the planet, and Gunra is among the most polished variants to come out of it.

By January 2026 the group had evolved from a standalone operation into a structured RaaS platform that works essentially like a franchise model for cybercrime. Advertised on dark web forums under the alias “Golden Community”, their affiliate programme offers management panels, configurable ransomware builders, cross-platform payloads for Windows and Linux, and thorough documentation. They actively recruit penetration testers and initial access brokers, dangling profit-sharing arrangements as bait.

But here’s where it gets geopolitically interesting: a joint analysis by South Korean cybersecurity firm AhnLab and multiple South Korean government agencies exposed links between Gunra and North Korea’s Lazarus Group, one of the most well-resourced state-backed threat actors out there. That’s not just a criminal gang anymore but a potential nation-state operation with ransomware as a revenue stream.

How they get in: Fortinet vulnerabilities

The front door, in most cases, is your Fortinet appliance. Gunra affiliates gain initial access by exploiting two authentication bypass vulnerabilities:

  • CVE-2024-55591: an authentication bypass via alternate path (CWE-288) in FortiOS and FortiProxy, allowing unauthenticated attackers to gain administrative privileges
  • CVE-2025-24472: a related authentication bypass in FortiOS and FortiProxy

Both target internet-facing firewall and VPN appliances, the exact devices sitting between your internal network and the wild internet. By compromising these, Gunra operators walk straight into the network with admin-level access, no phishing emails required, no tricking users into clicking dodgy links, just an unpatched box doing exactly what they need it to do.

The advisory also flags exploitation of credential-exposure flaws in VPN gateways, SSH access control weaknesses and (honestly, this one stings) default credentials on SSL-VPN appliances. The common thread is internet-facing infrastructure that hasn’t been patched or hardened, a pattern we see constantly in our own assessments and that never stops being frustrating.

What happens after initial access

Once inside, Gunra affiliates are methodical in a way that would almost be boring if “boring” weren’t a word that means your entire organisation is about to have a very bad week.

Lateral movement: They use Impacket utilities to move through the network via SMB, hijack active sessions and compromise Active Directory, and from there it’s IT workstations and servers with elevated privileges. They treat your network like their own.

Data exfiltration: Before they encrypt a single file, they steal everything worth stealing: business documents, databases, personally identifiable information, email communications. The FBI documented a custom executable called main.exe that specifically targets Microsoft OneDrive and SharePoint repositories, and the stolen data gets compressed and uploaded to the Mega file-sharing service. In at least one documented case the volume of exfiltrated data was measured in the tens of terabytes, which is not a typo.

Backup destruction: This is the part that really hurts. Using Windows Management Instrumentation (WMI) they delete volume shadow copies before encryption starts, and they don’t stop there because Gunra operators go after backup infrastructure directly, destroying copies from both primary and disaster recovery systems. If your backups are reachable from the network, they’re gone.

Encryption: Files get encrypted with ChaCha20 and RSA-4096 key wrapping, receiving the .ENCRT or .CRYPT extension, and a ransom note named R3ADM3.txt drops in affected directories. The Linux variant (introduced mid-2025) supports up to 100 parallel encryption threads and selective file encryption, meaning they can encrypt just enough of a large file to render it unusable while moving on to the next one at speed.

The extortion model

Double extortion, the classic approach: pay the ransom, get a decryptor and a promise that stolen data won’t be published; don’t pay, and it all goes up on Gunra’s leak site for the world to see. Victims get five to seven days to negotiate via a Tor-based portal or the qTox messaging platform.

Ransom demands exceed ten million dollars, and here’s a detail that’s almost funny: the FBI noted that Gunra actors have been contacting management staff at victim organisations directly via email to pressure them into paying. The advisory diplomatically notes this approach has had “limited success”, because it turns out that unsolicited emails demanding millions of dollars don’t always land well.

Confirmed victims span Brazil, Japan, Canada, Turkey, Taiwan, the United States and South Korea, across manufacturing, healthcare, IT, law firms and government agencies.

Why this advisory matters

The sheer number of agencies behind this thing tells its own story: FBI, CISA, NSA, DC3, the US Secret Service and South Korea’s National Police Agency. That level of international coordination doesn’t happen for minor threats but rather when governments believe organisations aren’t taking the warning seriously enough on their own.

The South Korean involvement isn’t incidental either, as it’s directly tied to the Lazarus connection. AhnLab’s research showed that Lazarus appears to share tools and infrastructure with Gunra while targeting South Korean organisations, which blurs the line between financially motivated cybercrime and state-sponsored operations in a way that should make everyone uncomfortable.

What organisations should do now

The advisory spells out specific defensive steps, and none of them are surprising if you’ve been paying attention, but that’s kind of the point because the basics keep being the things that matter most.

Patch Fortinet devices immediately. CVE-2024-55591 and CVE-2025-24472 are the documented entry points. If your organisation runs FortiOS or FortiProxy, verify the patches are applied, and if you can’t confirm when they were applied then assume potential compromise and investigate.

Audit all internet-facing VPN and firewall appliances. Default credentials, unnecessary SSH access, outdated firmware: these are the attack surfaces Gunra affiliates target first because it’s the low-hanging fruit and they know it.

Implement offline, immutable backups. Gunra destroys backup infrastructure before encrypting, so if your backups are connected to the network or accessible from compromised systems they will be deleted. Only offline, physically separated backups give you a real recovery path.

Segment your network. Lateral movement via SMB and Active Directory compromise is central to how Gunra operates. Segmentation won’t stop the initial breach, but it limits the blast radius, and that difference can be everything.

Deploy multi-factor authentication everywhere. VPN access, administrative interfaces, cloud services: credential-based attacks remain a primary way in, and MFA isn’t a silver bullet but it makes the attacker’s job meaningfully harder.

Monitor for data exfiltration indicators. Large-volume uploads to cloud storage services like Mega, unusual OneDrive or SharePoint access patterns, unexpected archive creation: these are the warning signs that show up before the encryption starts.

Map Gunra’s techniques against the MITRE ATT&CK framework. The advisory provides detailed TTP mappings which you should use to check your detection coverage and find the gaps in your monitoring.

The bigger picture

Gunra sits at the intersection of everything that makes modern ransomware dangerous: leaked source code from an established operation lowering the barrier to entry, a professionalised RaaS model that spreads the work across specialised affiliates, potential nation-state backing providing resources and intelligence, and systematic targeting of the infrastructure devices (firewalls, VPN gateways) that organisations rely on as their security boundary.

The Conti source code leak of 2022 keeps generating new threats four years on, and Gunra is the latest and one of the most operationally mature to emerge from that codebase. When six US agencies and South Korean law enforcement jointly tell the world to pay attention, the message is clear: this threat isn’t going away on its own.

We help organisations figure out whether they’d actually survive a Gunra-style attack, from scanning internet-facing infrastructure for the exact vulnerabilities being exploited to testing backup recovery under pressure to building incident response plans that work when the clock is ticking. Curious where your gaps are? Let’s talk.

Sources and further reading:

Autor: Andriu Isenring CISSP