A group of U.S. agencies and South Korea’s National Police Agency have issued a joint advisory warning that Gunra ransomware is operating as a ransomware-as-a-service platform targeting government, critical infrastructure and other organizations. The CISA advisory, published August 10, 2026, describes Gunra as a double-extortion threat that encrypts victims’ data and threatens to publish stolen information if they do not pay.

The advisory says Gunra first appeared in April 2025 and expanded into a formal affiliate program by January 2026. The program reportedly provided affiliates with a management panel, a configurable ransomware builder, cross-platform locker payloads and affiliate documentation. The FBI also observed the group using new branding aliases, including Golden Community, as it expanded its operations.

Gunra’s operating model relies on affiliates and initial access brokers. The agencies said the operators recruited penetration testers and ethical hackers to obtain enterprise network access in exchange for a share of ransom proceeds. Victims observed on the group’s dedicated leak site have included organizations in the Americas, Europe, the Middle East, Africa and the Asia-Pacific region.

The group typically exfiltrates sensitive data before encrypting systems. Ransom notes placed in affected directories direct victims to a Tor-based negotiation portal, where they receive a client ID and initial password. The advisory says victims are then instructed to communicate through qTox, an encrypted messaging application, and are given five to seven days to negotiate payment. If they do not pay, the operators threaten to publish or sell the stolen data on the leak site.

The FBI observed Gunra gaining initial access primarily by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN appliances. The advisory identifies CVE-2024-55591 and CVE-2025-24472, authentication-bypass vulnerabilities affecting certain FortiOS and FortiProxy versions, among the vulnerabilities used in observed attacks. South Korea’s National Police Agency also observed the exploitation of exposed credentials and SSH access-control weaknesses in internet-facing VPN gateways.

After entering a network, Gunra actors have used Impacket tools including psexec.py and smbclient.py to move laterally over the Server Message Block protocol. In one observed intrusion, the actors exploited default credentials on an SSL-VPN appliance where account lockout controls were absent, downloaded OpenSSH from an attacker-controlled server and used a VPN account with access to both internet-facing and internal networks. The advisory also describes lateral movement through remote desktop protocol after the actors obtained stolen session information for an internal virtual desktop infrastructure environment.

Gunra initially focused on Windows systems, but reporting cited in the advisory indicated that the group introduced a Linux variant during 2025 and moved toward broader cross-platform targeting. The Windows encryptor uses native operating-system APIs to enumerate files and directories across accessible drive letters before encrypting victim data. The agencies say the ransomware appears to be based on, or significantly influenced by, source code leaked from the Conti ransomware operation in 2022.

The agencies recommend that organizations first patch known exploited vulnerabilities in internet-facing systems, with particular attention to VPN gateways and infrastructure exposed through remote desktop protocol. They also advise implementing and testing offline, immutable backups in a physically separate and segmented location, allowing recovery without relying on ransom payment. Network segmentation should limit movement from an initially compromised device to other systems.

The advisory is aimed at government and critical-infrastructure organizations, including healthcare, financial services, manufacturing, transportation, utilities, academia, media, retail and professional and nonprofit services. It includes technical details mapped to the MITRE ATT&CK framework and downloadable indicators of compromise in STIX XML and JSON formats. The advisory also provides detection and mitigation guidance to help organizations protect against Gunra ransomware.