The U.S. Cybersecurity and Infrastructure Security Agency (CISA), FBI, National Security Agency (NSA), U.S. Secret Service and Republic of Korea’s National Police Agency have issued a joint #StopRansomware advisory on Gunra, a ransomware-as-a-service (RaaS) operation targeting governments, critical infrastructure and businesses across multiple sectors.
First observed in April 2025, Gunra has expanded in 2026 into an affiliate-based operation that gives other cybercriminals access to ransomware tooling, management infrastructure and documentation. Its business model is familiar but increasingly effective: steal sensitive information, encrypt systems, then threaten to publish the stolen data unless the victim pays.
The warning is global. According to the advisory, Gunra victims identified on the group’s leak site span the Americas, Europe, the Middle East, Africa and Asia-Pacific. Targeted sectors include healthcare, financial services, manufacturing, transportation, government, utilities, education, media, retail and professional services.
From ransomware variant to criminal enterprise
Gunra first appeared in 2025 as a sophisticated double-extortion ransomware variant reportedly derived from leaked Conti source code. By January 2026, investigators observed Gunra advertising a formal RaaS affiliate program on dark-web forums.
The shift is significant.
Instead of relying on one tightly controlled criminal team, the RaaS model allows multiple affiliates to conduct intrusions using a common ransomware platform. Gunra reportedly provides affiliates with a management panel, configurable ransomware builder, cross-platform payloads and supporting documentation.
The group has also used the name Golden Community and recruited individuals capable of obtaining initial access to corporate networks, including penetration testers and ethical hackers willing to operate as initial-access brokers.
This effectively turns ransomware into a supply chain: one criminal obtains access, another conducts the intrusion, another may deploy the encryption payload, while the operators behind the platform take a share of the proceeds.
The FBI has previously warned that RaaS lowers the technical barrier for criminals and can increase the number of actors capable of conducting ransomware attacks.
The attack starts at the edge
One of the clearest messages from the Gunra advisory is that organizations should pay particular attention to their internet-facing infrastructure.
Investigators observed Gunra affiliates exploiting known vulnerabilities in internet-facing devices, including firewall and VPN appliances. Among the vulnerabilities identified are:
- CVE-2024-55591, affecting certain FortiOS and FortiProxy versions.
- CVE-2025-24472, also affecting certain FortiOS and FortiProxy versions.
The actors also exploited exposed VPN infrastructure, credential weaknesses and SSH access-control problems.
This is an important reminder that the organization’s most important security boundary may also be its most exposed.
A compromised VPN gateway or firewall can provide attackers with the foothold they need to move deeper into an enterprise.
Once inside, Gunra goes after identity
Gunra’s activity demonstrates why ransomware defense can no longer be reduced to endpoint antivirus or simply having an EDR platform installed.
After obtaining access, investigators observed the actors moving laterally through environments using legitimate administrative protocols and tools, including RDP and SMB.
In some cases, attackers compromised administrator accounts and abused unused accounts that had access to both external and internal networks.
The actors also used tools from the Impacket framework – including psexec.py, smbclient.py and secretsdump.py – to facilitate lateral movement and credential theft.
Credential dumping from Active Directory domain controllers allowed attackers to obtain password hashes and subsequently use pass-the-hash and pass-the-ticket techniques.
The lesson for defenders is straightforward: identity is now one of the primary battlegrounds in ransomware attacks.
A stolen administrator credential can be considerably more valuable to an attacker than a malicious executable.
Even MFA can be attacked
One of the more concerning findings in the advisory involves multi-factor authentication.
In one victim environment, Gunra actors modified authentication-processing files on a virtual desktop infrastructure authentication server so that a specific attacker-controlled one-time password would successfully authenticate.
In other words, the attackers did not simply steal an MFA code they manipulated the authentication process itself.
Investigators also observed the theft of session information and cookies, enabling attackers to hijack authenticated sessions.
This illustrates an increasingly important distinction for security teams: MFA remains essential, but MFA alone is not a complete defense against a compromised identity infrastructure.
Organizations must protect the systems that enforce authentication, monitor changes to authentication mechanisms and investigate suspicious administrative activity around identity services.
Gunra steals data before it encrypts it
Gunra follows the now-standard double-extortion playbook.
Before encryption, the attackers collect sensitive information that can be used as additional leverage against the victim.
The FBI observed theft of:
- Business-critical documents
- Databases
- Personally identifiable information
- Internal email communications
- Network and system configuration information
- Data stored in Microsoft OneDrive and SharePoint
In one documented case, attackers created compressed archives and exfiltrated them to Mega, with the volume of stolen information reaching tens of terabytes.
Tools such as RClone, FileZilla, 7-Zip and WinRAR were observed in the attackers’ activity.
These are legitimate tools. That matters.
Security teams should not automatically classify every instance of RClone or 7-Zip as malicious. Instead, they should investigate unusual usage patterns particularly unexpected large-scale transfers, archive creation, cloud-storage activity and execution from unusual accounts or systems.
The final stage: fast, destructive encryption
Once the attackers have obtained the data they want, Gunra deploys its ransomware payload.
The ransomware supports both Windows and Linux, expanding the potential attack surface inside organizations.
The Windows variant uses a multi-threaded architecture and combines ChaCha20 and RSA-4096 encryption. Encrypted files may receive the .ENCRT extension, while a documented 2025 sample used .CRYPT.
The ransomware also attempts to prevent recovery.
Investigators observed Gunra using Windows Management Instrumentation to delete volume shadow copies. In one victim environment, attackers went further and deleted backup and archived data located at both the primary data center and disaster recovery center.
That is why backups must not simply exist they must be protected from the attacker who compromises the production environment.
A potentially important recovery window for some Linux victims
There is one unusual technical detail in the advisory that defenders should not overlook.
Researchers identified a weakness in Gunra’s Linux ELF variants, which use the .GNRA extension. The encryption keys reportedly rely on a predictable pseudorandom number generator seeded with srand(time(NULL)).
Under the right circumstances, investigators may be able to reconstruct encryption keys using file timestamps and recover affected files without paying the ransom.
This should not be interpreted as a universal decryptor. Organizations affected by a Linux Gunra variant should preserve encrypted files, timestamps, ransom notes and relevant system logs and involve qualified incident-response or forensic specialists before attempting recovery.
Why the Gunra warning matters to the Middle East and Africa
The Gunra advisory explicitly identifies victims across the Middle East and Africa.
That matters because the region is experiencing rapid digital transformation across banking, telecommunications, energy, government, healthcare, logistics and critical infrastructure.
Many organizations are also expanding remote access, cloud services and interconnected operational environments faster than their security architectures are being modernized.
For organizations in Africa and the Middle East, the Gunra case reinforces three priorities:
First, internet-facing infrastructure must be treated as a high-priority security asset. VPNs, firewalls and remote-access gateways require continuous vulnerability management not occasional patching.
Second, identity infrastructure deserves the same attention as endpoints. Privileged accounts, Active Directory, VPN identities, service accounts and authentication systems can determine whether an attacker remains isolated or reaches the heart of an organization.
Third, resilience must be designed around the assumption that attackers will reach the network. Segmentation and immutable backups can turn a potentially catastrophic ransomware incident into a contained security event.
CyberCory has previously examined how ransomware groups are increasingly combining data theft, cloud abuse and encryption. The recent analysis of Qilin’s exploitation of VPN infrastructure and Rclone-based data exfiltration provides useful additional context for security leaders.
10 actions security teams should take now
1. Patch internet-facing systems first
Prioritize known exploited vulnerabilities affecting VPN gateways, firewalls, remote-access infrastructure and other systems exposed directly to the internet.
2. Audit VPN and RDP exposure
Identify every externally accessible VPN, RDP and remote-management service. Remove unnecessary exposure and place legitimate remote access behind strong authentication and appropriate access controls.
3. Enforce MFA everywhere it matters
Require MFA for VPNs, webmail, administrative accounts and access to critical systems. Where possible, use phishing-resistant authentication mechanisms.
4. Hunt for suspicious accounts
Review Active Directory, domain controllers, VPN appliances and critical servers for newly created, dormant or unexpected accounts.
5. Lock down privileged access
Apply least privilege and remove unnecessary administrative rights. Separate administrator accounts from ordinary user accounts.
6. Segment the network
Separate users, servers, backups, administrative systems and critical infrastructure. Network segmentation can limit an attacker’s ability to move from one compromised machine to the rest of the organization.
7. Protect backups from ransomware
Maintain multiple backup copies, including offline or immutable copies stored in a physically or logically separate environment. Test restoration regularly.
8. Monitor legitimate tools for abnormal behavior
RClone, FileZilla, 7-Zip, WinRAR, AnyDesk, Impacket and similar tools can have legitimate uses. Monitor for unusual execution, privilege escalation, large archive creation and unexpected outbound data transfers.
9. Hunt for credential theft and lateral movement
Look for suspicious use of secretsdump, SMB administrative shares, RDP, pass-the-hash activity, unusual authentication events and unexpected modifications to authentication systems.
10. Test your defenses against the actual attack chain
Map detection and prevention controls against the MITRE ATT&CK techniques identified in the advisory. Test them rather than assuming they work. Detection rules, EDR policies, SIEM alerts, backup recovery and incident-response procedures should all be validated through exercises.
Organizations looking to strengthen their broader cybersecurity architecture, SOC capabilities, vulnerability management and incident-response readiness can review Saintynet Cybersecurity. Its training and awareness programs also provide practical options for developing defensive cybersecurity skills. Saintynet Cybersecurity Training
What organizations should do if Gunra is suspected
If an organization suspects a Gunra compromise, the priority should be containment and evidence preservation—not immediately negotiating with the attackers.
Potentially compromised systems should be isolated while responders determine the scope of the intrusion. Security teams should preserve ransom notes, logs, timestamps and encrypted files and investigate compromised accounts, VPN appliances, Active Directory and other privileged infrastructure.
Threat hunting should focus on identifying the initial access point, persistence mechanisms, credential theft, lateral movement and data exfiltration that occurred before encryption.
Organizations should also consider reporting the incident to appropriate law-enforcement and cybersecurity authorities.
The FBI and CISA continue to discourage ransom payments. Payment does not guarantee that data will be recovered and can incentivize further criminal activity.
The bigger ransomware lesson
Gunra is not simply another ransomware name to add to a threat-intelligence dashboard.
It represents the continued industrialization of cybercrime.
A leaked ransomware codebase has evolved into a commercial criminal platform. Affiliates can obtain access, deploy tooling, steal enormous volumes of information and pressure victims through both operational disruption and public exposure.
For defenders, the response cannot be a single security product.
It requires vulnerability management, identity protection, network segmentation, endpoint visibility, cloud monitoring, immutable backups, trained personnel and a rehearsed incident-response capability working together.
The Gunra warning ultimately reinforces one of the oldest principles in cybersecurity: organizations cannot always prevent attackers from attempting to enter but they can make it significantly harder for an initial compromise to become a business-wide catastrophe.
Source: CISA, FBI, NSA, U.S. Secret Service and Republic of Korea National Police Agency, #StopRansomware: Gunra Ransomware, AA26-222A, August 10, 2026.
