A coalition of U.S. and South Korean agencies on August 10 issued a joint advisory warning that Gunra ransomware has expanded into a ransomware-as-a-service operation targeting government, critical infrastructure, and other organizations. The advisory describes Gunra as a double-extortion threat: affiliates encrypt victims’ data, exfiltrate sensitive information, and threaten to publish it on a dedicated leak site if the ransom is not paid. The Cybersecurity and Infrastructure Security Agency published the alert as part of the #StopRansomware effort.

The FBI first observed Gunra in April 2025, according to the advisory. By January 2026, the operators had launched a formal affiliate program on dark web forums that offered a management panel, a configurable ransomware builder, cross-platform locker payloads, and documentation for affiliates. The group also adopted branding aliases, including Golden Community, and recruited penetration testers and ethical hackers as initial access brokers in exchange for a share of ransom proceeds.

Gunra’s infrastructure includes a Tor-based negotiation portal and a dedicated leak site. Victims receive ransom notes in affected directories directing them to the portal, where they are assigned a client ID and initial password. The actors then instruct victims to communicate through qTox, an encrypted messaging application, and demand negotiations within five to seven days. If payment is not made, the operators threaten to publish or sell the stolen data through the leak site.

The advisory says victims listed on Gunra’s leak site span the Americas, Europe, the Middle East, Africa, and the Asia-Pacific region. The affected sectors include healthcare and public health, financial services and insurance, critical manufacturing and construction, transportation and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services.

Investigators observed Gunra actors obtaining access primarily by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN appliances. The advisory identifies CVE-2024-55591 and CVE-2025-24472, both authentication-bypass vulnerabilities affecting specified FortiOS and FortiProxy versions. South Korea’s National Police Agency also observed exploitation of credential exposure and Secure Shell access-control weaknesses in internet-facing VPN gateways.

The agencies described additional activity after the initial compromise. Gunra operators used the Impacket tools psexec.py and smbclient.py to move laterally through networks over the Server Message Block protocol. In one case observed by the Korean agency, the actors used default credentials on an SSL-VPN appliance where account-lockout controls were absent, accessed an administrative console, and modified an unused account so it could bypass a mandatory password change. The actors then used stolen session information to enter an internal virtual desktop infrastructure environment and move through it with Remote Desktop Protocol.

The Windows encryptor enumerates files and directories across accessible drive letters before encrypting victim data, using the native FindFirstFileW and FindNextFileW operating-system APIs. The advisory says Gunra initially focused on Windows environments, while reporting from mid-2025 indicated that the group had introduced a Linux variant and was moving toward broader cross-platform targeting. The agencies assess that the ransomware appears based on, or significantly influenced by, source code leaked from the Conti ransomware operation in 2022.

The alert directs organizations to prioritize patching known exploited vulnerabilities in internet-facing systems, particularly VPN gateways and infrastructure exposed through Remote Desktop Protocol. It also calls for implementing and testing offline, immutable backups kept in a physically separate and segmented location to ensure recoverability without ransom payment. Network segmentation is recommended to limit movement from an initially compromised device to other systems.

The advisory includes technical detection and mitigation guidance for cybersecurity architects, defensive analysts, vulnerability analysts, system administrators, and security managers. It also provides downloadable indicator-of-compromise files in STIX XML and JSON formats. The warning and guidance are intended for organizations in the government, critical infrastructure, and other sectors identified in the advisory.