U.S. and South Korean agencies have issued a new joint warning on Gunra, a ransomware-as-a-service operation that has moved from a 2025 double-extortion variant into a broader affiliate platform targeting government, critical infrastructure, healthcare, finance, utilities, transportation, education, media, retail, and professional-services organizations.
The August 10 advisory, co-authored by the FBI, CISA, the Defense Department Cyber Crime Center, NSA, the U.S. Secret Service, and South Korea’s National Police Agency, gives defenders a useful message: treat Gunra as an edge-access and recovery problem before it becomes an encryption problem. The agencies point to exploited internet-facing systems, VPN gateways, exposed RDP infrastructure, credential theft, OneDrive and SharePoint exfiltration, and backup destruction as recurring parts of observed activity.
That makes the first response more specific than a broad ransomware reminder. Organizations should verify patched FortiOS and FortiProxy exposure, review VPN and remote-access logs, hunt for credential dumping and lateral movement, and test whether offline backups can actually support recovery if primary and disaster-recovery backup systems are touched.
What the advisory says happened
Gunra first appeared in April 2025, according to the advisory, and quickly stood up a Tor-based leak site for publishing victim data. By January 2026, the group had launched a formal ransomware-as-a-service affiliate program with a management panel, configurable ransomware builder, cross-platform locker payloads, and affiliate documentation.
The FBI observed the group using new branding, including Golden Community, as part of that expansion. The advisory also says Gunra has tried to recruit penetration testers and ethical hackers to act as initial access brokers in exchange for a share of ransom proceeds.
The operation follows a familiar double-extortion pattern: steal sensitive data, encrypt systems, then threaten publication if the victim does not pay. Victims are directed to a Tor-based negotiation portal and qTox for negotiations, typically under a five- to seven-day deadline. The FBI observed initial ransom demands starting at arbitrarily high amounts, including tens of millions of dollars.
Gunra appears to be based on, or heavily influenced by, the Conti ransomware source code leaked in 2022. It initially focused on Windows environments, but reporting in 2025 and 2026 documented Linux and broader cross-platform targeting. CloudSEK, which analyzed Gunra’s affiliate program and locker earlier this year, described a ChaCha20 and RSA-4096 hybrid encryption design, multi-threaded execution, and configurable targeting logic.
The access path starts at the edge
The advisory says Gunra actors have obtained initial access primarily by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN appliances. The FBI specifically observed exploitation based on CVE-2024-55591 and CVE-2025-24472, both affecting FortiOS and FortiProxy versions. South Korea’s police agency also observed credential-exposure and SSH access-control weaknesses in internet-facing VPN gateways.
Those details matter because they put the practical priority on edge systems that may sit outside ordinary endpoint patching routines. A Windows server rebuild will not fix the original problem if the VPN appliance still has an exposed administrative path, a vulnerable firmware version, default credentials, an unused privileged account, or stale session cookies that let attackers return.
In one observed case, Gunra actors gained access to an SSL-VPN administrator account by exploiting default credentials where account lockout controls were missing. They then downloaded OpenSSH from an attacker-controlled server to maintain connections between compromised systems. In another sequence, they used an internet-connected workstation tied to a network administrator to reach the VPN administrative console, find an unused account with both internet-facing and internal access, and modify that account to bypass mandatory password-change requirements.
Credential theft turns one breach into many
Gunra’s intrusion pattern is not limited to ransomware deployment. The advisory describes use of Impacket tools including psexec.py and smbclient.py for SMB-based lateral movement, and secretsdump.py for extracting password hashes from the NTDS file on compromised domain controllers. That creates pass-the-hash and pass-the-ticket paths into other privileged systems.
The South Korean cases add another layer. In one victim environment, the attackers manipulated SSL-VPN traffic-control functionality to collect credentials and session information sent by users authenticating to a corporate VDI portal. They then used stolen session cookies to hijack sessions and impersonate legitimate users. The same incident included tampering with VDI authentication processing files so that a specific attacker-designated one-time password would allow successful login, effectively creating a persistent MFA bypass.
For defenders, that means recovery cannot stop at password resets. Teams should assume that privileged hashes, session material, VPN account configuration, VDI authentication files, and internal access-control databases may all need review. The advisory also describes a case where attackers stole a symmetric encryption key from a Hiware system access-control server, used it to decrypt stored enterprise server passwords, and then dumped credentials for enterprise servers.
Cloud files and backups are part of the target set
Before encryption, Gunra actors collected business-critical documents, databases, personally identifiable information, and internal email communications. The FBI observed a malicious executable named main.exe used to exfiltrate data from Microsoft OneDrive and SharePoint. In at least one case, attackers compressed sensitive data into archives and sent it to the MEGA file-sharing service; the advisory says exfiltration volumes ranged up to tens of terabytes.
That cloud-file behavior should change the incident checklist. Microsoft 365 administrators should review OneDrive and SharePoint access patterns, unusual file enumeration, large archive creation, suspicious downloads, OAuth or session anomalies, and service-account activity around the intrusion window. Security teams should also check whether attackers accessed IT staff VDI environments, because the advisory notes collection of sensitive system and network configuration documents from those desktops.
Gunra’s encryption phase is built for speed. The Windows binary uses native Windows APIs to enumerate accessible drive letters from A through Z, filters out common system directories and file types, and queues user data such as documents, databases, images, and archives. Encrypted files typically receive the .ENCRT extension, while one July 2025 sample used .CRYPT. Ransom notes are written as R3ADM3.txt in affected directories.
The recovery problem gets harder because the actors have targeted backups. The advisory says Gunra actors used Windows Management Instrumentation to delete volume shadow copies before encryption, and in one case deleted backup and archived data in both primary and disaster-recovery environments before and after ransomware deployment.
What defenders should do first
The highest-value work starts with systems that can let attackers in or let them come back. Patch known exploited vulnerabilities in internet-facing VPN, firewall, and RDP-exposed infrastructure. Verify FortiOS and FortiProxy versions, inspect administrative account changes, remove unused privileged accounts, enforce account lockout and phishing-resistant MFA where possible, and review VPN logs for late-night access patterns. The advisory notes that Gunra actors often conduct reconnaissance between 10 p.m. and 6 a.m.
Next, hunt for tool use in context rather than by name alone. FileZilla, RClone, 7-Zip, WinRAR, DBeaver, MobaXterm, AnyDesk, Google Remote Desktop, Mimikatz, Sliver, Amass, and Impacket can all be legitimate in some environments, but their presence on unusual hosts or under unusual accounts deserves investigation. Look especially for Impacket activity against domain controllers, large compressed archives, MEGA exfiltration, unexpected remote desktop sessions, and WMI commands deleting shadow copies.
Backups need a separate test, not a line item in a policy document. CISA and its partners recommend offline, immutable backups stored in a physically separate and segmented location. For Gunra-style incidents, that also means proving backup credentials, backup consoles, disaster-recovery storage, and restoration workflows were not reachable from the same compromised identity path.
If indicators appear, organizations should preserve logs and affected systems before rebuilding, isolate compromised hosts, revoke exposed sessions, rotate privileged credentials, review cloud-file access, and contact law enforcement or CISA. Ransomware response is messy enough without discovering during recovery that the original VPN path, the VDI login flow, or the backup admin account was never cleaned.
Gunra is not novel because it encrypts files. It is dangerous because it links edge-device compromise, identity theft, cloud-data exfiltration, and backup destruction into one operational chain. That is the part defenders can act on now.
