U.S. and South Korean law enforcement and cybersecurity agencies have issued a joint advisory warning that Gunra ransomware has expanded into a ransomware-as-a-service operation targeting government, critical infrastructure, and other organizations. The advisory, published August 10, 2026, says Gunra affiliates use a double-extortion model that encrypts victims’ data and threaten to publish stolen information on a dedicated leak site. The Cybersecurity and Infrastructure Security Agency advisory includes technical details, indicators of compromise, and mitigation guidance for network defenders.

The Federal Bureau of Investigation, CISA, the Department of Defense Cyber Crime Center, the National Security Agency, the U.S. Secret Service, and the Republic of Korea’s National Police Agency jointly issued the warning. The agencies said the variant first emerged in April 2025 and expanded into a structured affiliate program by early 2026. The program was advertised on dark web forums and provided affiliates with a management panel, a configurable ransomware builder, cross-platform locker payloads, and affiliate documentation.

The FBI observed Gunra maintaining a Tor-based leak site to list victims and publish exfiltrated data. The group also operates a Tor-based negotiation portal. Ransom notes placed in affected directories direct victims to that portal, where they receive a client ID and initial password. Victims are then instructed to use qTox, an encrypted messaging application, to negotiate payment within five to seven days. The actors threaten to publish or sell victim data if the ransom is not paid, the advisory says.

Gunra’s known victims span the Americas, Europe, the Middle East, Africa, and the Asia-Pacific region. The sectors identified in the advisory include healthcare and public health, financial services and insurance, critical manufacturing and construction, transportation and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services.

The agencies said Gunra actors primarily gained initial access by exploiting known vulnerabilities in internet-facing devices, including firewall and virtual private network appliances. The advisory identifies CVE-2024-55591 and CVE-2025-24472, authentication-bypass vulnerabilities affecting certain FortiOS and FortiProxy versions. South Korea’s National Police Agency also observed exploitation of credential exposure and Secure Shell access-control weaknesses in internet-facing VPN gateways.

After entering a network, Gunra actors have used Impacket tools including psexec.py and smbclient.py to move laterally over the Server Message Block protocol. In one observation, the actors exploited default credentials on an SSL-VPN appliance where account lockout controls were absent, downloaded OpenSSH from an attacker-controlled server, and used an account connected to both internet-facing and internal networks. The advisory also describes lateral movement through remote desktop protocol and access to multiple critical systems.

The ransomware initially focused on Windows environments, but reporting in mid-2025 indicated the introduction of a Linux variant and broader cross-platform targeting. The Windows encryptor uses native operating-system APIs to enumerate files and directories across accessible drive letters before encrypting victim data. The agencies said Gunra appears to be based on, or significantly influenced by, the Conti ransomware source code leaked in 2022.

The advisory urges organizations to prioritize patching known exploited vulnerabilities in internet-facing systems, especially VPN gateways and infrastructure exposed through remote desktop protocol. It also calls for offline, immutable backups stored and tested in a physically separate, segmented location, along with network segmentation to limit movement from an initially compromised device. Defenders can download the advisory’s STIX XML and JSON files for the listed indicators of compromise, while the authoring agencies’ recommendations provide the immediate mitigation steps for organizations at risk.