Federal cybersecurity agencies have issued an advisory on Gunra, a ransomware-as-a-service operation that uses affiliates to target government, critical infrastructure, and other organizations. The Cybersecurity and Infrastructure Security Agency published the joint advisory on August 10, 2026, with technical details, indicators of compromise, and mitigation guidance for network defenders.

Gunra uses a double-extortion model. Its operators exfiltrate sensitive data before encrypting files, then threaten to publish or sell the stolen information if victims do not pay. The group maintains a dedicated leak site on the Tor network and directs victims to a Tor-based negotiation portal through ransom notes placed in affected directories.

The FBI first observed Gunra in April 2025. The advisory says the variant appeared to be based on, or significantly influenced by, the Conti ransomware source code leaked in 2022. Gunra initially focused on Windows environments, while reporting from mid-2025 indicated the introduction of a Linux variant and a move toward broader cross-platform targeting.

By January 2026, Gunra had launched a formal affiliate program on dark web forums. The program provided affiliates with a management panel, a configurable ransomware builder, cross-platform locker payloads, and documentation for participants. The FBI also observed the group using new branding aliases, including Golden Community, and recruiting penetration testers and ethical hackers as initial access brokers in exchange for a share of ransom profits.

Victims listed on Gunra’s leak site span organizations in the Americas, Europe, the Middle East, Africa, and the Asia-Pacific region. The advisory identifies affected or at-risk sectors including healthcare and public health, financial services and insurance, critical manufacturing and construction, transportation and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services.

The FBI observed Gunra obtaining access primarily by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN appliances. The advisory identifies CVE-2024-55591 and CVE-2025-24472, authentication-bypass vulnerabilities affecting specific FortiOS and FortiProxy versions. South Korea’s National Police Agency also observed the actors exploiting credential exposure and Secure Shell access-control weaknesses in internet-facing VPN gateways.

After gaining access, Gunra actors have used Impacket tools including psexec.py and smbclient.py to move laterally over the Server Message Block protocol. In one case described by the advisory, the actors exploited default credentials on an SSL-VPN appliance where account lockout controls were absent, then used OpenSSH downloaded from an attacker-controlled server to establish connections between compromised systems. The agencies also observed lateral movement through remote desktop protocol and the use of stolen session information to enter an internal virtual desktop infrastructure environment.

The agencies’ immediate guidance is to prioritize patching known exploited vulnerabilities in internet-facing systems, particularly VPN gateways and infrastructure exposed through remote desktop protocol. Organizations should implement and test offline, immutable backups in a physically separate and segmented location, and segment networks to limit movement from an initially compromised device. The advisory also includes downloadable STIX XML and JSON files containing indicators of compromise for defensive monitoring.