A joint Transpacific advisory against Gunra

On August 10, 2026, an unprecedented joint advisory published under the identifier AA26-222A as part of the #StopRansomware campaign warns government organizations and critical infrastructure worldwide about the ransomware Gunra. Signed by the FBI, CISA, Department of Defense Cyber Crime Center (DC3), NSA, U.S. Secret Service (USSS), and the National Police Agency of the Republic of Korea (KNPA), this leading technical document crystallizes several months of shared investigations between Washington and Seoul.

“Gunra is a new variant in the ongoing trend of ransomware attacks causing disruptions and damages to U.S. and international organizations,” stated Chris Butera, acting Deputy Executive Director for Cybersecurity at CISA, as quoted by The Hacker News.

The alert targets a wide range of sectors: public health, financial services and insurance, critical manufacturing and construction, transportation and logistics, governmental services, utilities, academia, media and communications, retail, and professional or nonprofit services. The victims identified on the attackers' data leak site (DLS) span the Americas, Europe, the Middle East, Africa, and the Asia-Pacific region.

From April 2025 to January 2026: from a Conti variant to a RaaS platform

Gunra emerged in April 2025 as a double-extortion ransomware variant derived from the source code of Conti — this code had leaked in February 2022, fueling a nebula of descendants since then. The model combines data encryption and prior exfiltration, with a threat of publication on a dedicated leak site (DLS) hosted on the Tor network.

The structural turning point comes in January 2026: Gunra launches a formal ransomware-as-a-service (RaaS) program on dark web forums. Affiliates gain access to a management panel, a configurable ransomware builder, cross-platform locking payloads, and structured documentation. To accompany this expansion, the group adopted a new brand alias, “Golden Community,” and began actively recruiting pentesters and ethical hackers as initial access brokers (IAB), in exchange for a share of the ransoms collected.

This professionalization is accompanied by a technical broadening: after initial campaigns focused on Windows, Gunra introduced a Linux variant in mid-2025, steering its operations towards a cross-platform approach.

Known and exploited entry vectors

Authorities highlight the exploitation of already identified and patched vulnerabilities in equipment exposed to the Internet, making rapid patching all the more critical. CISA specifically cites:

  • CVE-2024-55591 and CVE-2025-24472 — two critical authentication bypass vulnerabilities affecting FortiOS and FortiProxy (Fortinet);
  • exploitation of credential exposure flaws and SSH access control on exposed VPN gateways.

For its part, The Hacker News adds that attack chains also took advantage of a vulnerability on Schneider Electric PowerLogic P5 devices (CVE-2024-5559), underscoring the diversity of targeted peripheral devices.

Massive exfiltration, sometimes tens of terabytes

Gunra prioritizes exfiltration before encryption. Investigators observed the use of an executable named main.exe to extract data from Microsoft OneDrive and SharePoint, as well as the compression of volumes reaching tens of terabytes sent to the MEGA sharing service. The attackers harvest critical documents, databases, personally identifiable information (PII), and internal communications.

The encryption itself relies on a multithreaded architecture using ChaCha20 + RSA-4096, with file extensions .ENCRT (and .CRYPT in a July 2025 sample) and a static ransom note titled R3ADM3.txt. Victims are directed to a Tor negotiation portal and the encrypted messaging application qTox, with a delay of 5 to 7 days before data publication. The initial demands often start “at arbitrarily high amounts, exceeding tens of millions of U.S. dollars,” according to CISA.

To paralyze recovery, the attackers delete shadow volume copies via WMI and, in at least one case, have destroyed backups of the main data centers and recovery sites, before and after the ransomware deployment.

Elevation techniques and MFA bypass

The technical detail of the advisory reveals particularly sophisticated intrusion processes:

  • Lateral movement via Impacket libraries (psexec.py, smbclient.py) over SMB, and credential dumping with secretsdump.py against domain controllers (extracting NTDS hashes, pass-the-hash / pass-the-ticket);
  • Session hijacking: manipulation of the traffic control of an SSL-VPN device to intercept user credentials and session cookies authenticating to a corporate VDI portal;
  • MFA bypass: modification of the authentication processing files of the VDI portal so that a specific OTP value designated by Gunra allows for continuous successful authentication;
  • Symmetric key theft on an access control server Hiware via SSH, to decrypt passwords of corporate servers stored in the database;
  • Activity concentrated between 10 PM and 6 AM to evade administrators, deletion of logs and command history.

These methods remind us that Gunra does not settle for simple “mass encryption”: it conducts a deep takeover of the target environment before the final impact.

A cryptographic failure on the Linux variant

A notable element, reported by The Hacker News and attributed to an analysis by Breakglass Intelligence published in March 2026: the Linux builds of Gunra exhibited a “catastrophic cryptographic weakness” allowing the recovery of the encryption key and restoration of access to files. This flaw could offer a lifeline to victims of the Linux variant — a rarity in the contemporary ransomware landscape.

The Lazarus Trail: a state-criminal collaboration?

The joint advisory echoes earlier work by the South Korean firm AhnLab, conducted in collaboration with several South Korean government agencies, which exposed links between Gunra and the Lazarus group, the North Korean state-sponsored cyber-attack unit.

According to AhnLab, some operations involved exploiting vulnerabilities in unidentified financial security software — through targeted phishing and watering hole attacks — to distribute malware, and some of these intrusions led to the deployment of Gunra. Watering hole attacks reportedly exploited a zero-day in AnySign4PC (certificate signing software), with payloads like Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE), both associated with Lazarus.

“Although the state group and the Gunra ransomware group appear to be distinct actors with different end goals, they may have been able to share some techniques, tools, and infrastructure, or collaborate in a limited way during the attacks,” emphasizes AhnLab.

This scenario is not unprecedented. As early as October 2024, Palo Alto Networks Unit 42 documented the partnership between Andariel (a sub-cluster of Lazarus) and the Play ransomware group. Andariel has also deployed its own ransomware (SHATTEREDGLASS, Maui, H0lyGh0st), and more recently, Lazarus and the intrusion set Moonstone Sleet have been linked to attacks using Qilin and Medusa ransomware against entities in South Korea and the Middle East.

A measured but geographically concentrated toll

According to data published on Ransomware.Live, Gunra has listed 51 victims since its emergence in April 2025, primarily in South Korea, Brazil, Spain, Thailand, and Hong Kong. The majority of targets are concentrated in Australia, East Asia, and Europe — only three victims have been recorded in Canada and the United States to date, suggesting an operational prioritization of Asian and European targets, even as the advisory insists on the global nature of the threat.

Recommendations and protective measures

The authoring agencies urge network defenders to promptly adopt several measures:

  1. Prioritize patching known and exploited vulnerabilities on systems exposed to the Internet — particularly VPN gateways and RDP infrastructures, as well as affected Fortinet firewalls and Schneider equipment;
  2. Implement and test offline, immutable backups, stored in a physically separate and segmented location;
  3. Segment networks to limit lateral movement from a compromised device;
  4. Harden the configuration of SSL-VPN devices (disabling unused accounts, account lockout controls, default credential rotation);
  5. Monitor for unusual usage of legitimate tools being misused (Impacket, RClone, 7-Zip, FileZilla, AnyDesk, Mimikatz, Sliver, etc.) and large transfers to MEGA.

CISA also provides indicators of compromise (IOC) in STIX format (XML and JSON) to aid in detection. As alliances between state actors and criminal groups proliferate, Gunra illustrates a new paradigm: the boundary between lucrative cybercrime and state operations is diminishing, and international cooperation — like this U.S.-South Korean joint advisory — becomes one of the few effective countermeasures.