Loading story…
U.S. and South Korean cyber authorities issued a joint warning that the Gunra ransomware-as-a-service operation is targeting government and critical infrastructure organizations worldwide, using a double-extortion model that steals data before encrypting systems and threatening publication on a Tor-based leak site. The group, which appears derived from leaked Conti source code and emerged in 2025 before expanding into a formal affiliate program in 2026, has hit sectors including healthcare, finance, government, manufacturing, transportation, utilities, academia, media, and retail across multiple regions. Authorities said Gunra and its affiliates recruit initial access brokers, including penetration testers and self-described ethical hackers, and often demand more than $10 million with payment deadlines of five to seven days.
The advisory says Gunra commonly gains privileged access by exploiting known vulnerabilities in internet-facing infrastructure, particularly Fortinet firewalls, as well as VPN and RDP-exposed systems, before moving laterally, stealing data, and deploying ransomware on Windows and Linux environments. Separate research on the Linux variant found a major cryptographic flaw: the malware generates ChaCha20 key material with rand() seeded by time(), potentially allowing defenders to recover .GNRA files without paying if timestamps are preserved. Officials urged organizations to rapidly patch exposed edge devices, segment networks, and maintain offline immutable backups, while researchers also noted operational-security mistakes by the group and reported possible overlap between Gunra activity and infrastructure or tradecraft previously associated with North Korean actors in attacks on South Korean targets.
TTPs, infrastructure, and targeting history in one profile.
14 events from the most recent confirmed update back to the earliest known activity.
CISA, the FBI, South Korea's National Police Agency, and other partners issued a #StopRansomware advisory warning that Gunra targets government and critical infrastructure organizations, uses double extortion, and exploits known vulnerabilities in internet-facing devices including Fortinet firewalls and VPNs.
AhnLab published research noting overlap between Gunra activity and North Korean government-linked tradecraft, assessing that techniques, tools, and infrastructure may have been shared or collaboration may have occurred to a limited extent.
Four ELF Gunra samples for x86-64, i386, and two ARM architectures were uploaded to MalwareBazaar, showing broader Linux platform support.
In March 2026, researchers reported that Gunra's Linux variant used time()-seeded rand() to generate ChaCha20 key material, allowing defenders to reconstruct keys from file timestamps and potentially recover encrypted files without paying.
Earlier in 2026, Gunra's leak site claimed semiconductor firm Trio-Tech as a victim. In a March 2026 SEC filing, Trio-Tech acknowledged a material cybersecurity event that resulted in the leaking of company data.
Gunra's affiliate recruitment post reportedly appeared on the RAMP dark web forum, marking its move toward a ransomware-as-a-service model.
Five Gunra-related .onion domains were listed in ThreatFox, providing infrastructure visibility into the operation.
By January 2026, authorities said Gunra had transitioned into a formal affiliate-driven ransomware-as-a-service operation and began recruiting members and initial access brokers under aliases including Golden Community.
Gunra reportedly attacked INHA University in South Korea and exfiltrated 650 GB of data.
In October 2025, U.S. authorities warned that Gunra was exploiting FortiOS vulnerabilities CVE-2024-55591 and CVE-2025-24472 to bypass MFA, create a persistent super-admin account via scheduled tasks, steal data, and deploy ransomware. The notice urged organizations to patch exposed Fortinet firewalls and VPNs and harden remote-access systems.
By July 2025, Gunra had expanded beyond Windows and developed a Linux variant of its ransomware.
Researchers and the FBI said Gunra first emerged or was first observed in April 2025 as a Windows-focused ransomware operation, along with its leak site.
The Conti ransomware source code leak later became the basis for assessments that Gunra was built from or influenced by Conti code.
The reference reports that Gunra claimed to steal 40 terabytes of data from a hospital in Dubai, illustrating the group's double-extortion activity against the healthcare sector. The article says the stolen data included enterprise information such as documents, databases, personal data, and internal email.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 44 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
25 references tracked. Mallory keeps watching after this page renders.
fortra.com
Open sourcewaterisac.org
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcecve.org
Open sourcesdxcentral.com
Open sourcebroadcom.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean authorities and AhnLab disclosed **Operation Double Barrel**, a campaign that targeted Korean citizens and businesses from 2025 through the first half of 2026 by exploiting vulnerabilities in Korean financial security software. The activity used **watering hole** and **spear-phishing** attacks to direct victims to malicious URLs, after which attackers deployed backdoors including **Struggle** (also tracked as `SIGNBT 3.0`) and **Brandoor** (`COPPERHEDGE`). Legitimate Korean websites in media, education, healthcare, and manufacturing were abused as part of the watering hole infrastructure, and investigators said the pattern also raised possible **supply-chain** concerns tied to a shared website development and management company. The same software flaws were also used in separate intrusions that delivered **Gunra ransomware**, leading to file encryption and data exfiltration. A joint cybersecurity advisory issued by South Korea's **National Intelligence Service**, **National Police Agency**, **Korea Internet & Security Agency**, and **Financial Security Institute** said overlapping vulnerabilities, malware characteristics, SSH key fingerprints, and network infrastructure indicate possible limited collaboration or shared tooling between a state-sponsored threat actor and the Gunra ransomware group, although the relationship has not been confirmed definitively.
Aug 3, 2026
The FBI and CISA issued a joint FLASH warning that the **Ragnar Locker** ransomware gang breached at least **52 organizations across 10 U.S. critical infrastructure sectors**, including critical manufacturing, energy, financial services, government, and information technology. The agencies said the group has been active since at least late 2019 and uses **double extortion**, stealing data before encrypting systems and threatening to publish stolen files on its leak site; stolen data from at least 10 victims had already been posted. The alert detailed Ragnar Locker tradecraft, including use of **VMProtect**, **UPX**, and custom packing, deployment from a custom **Windows XP virtual machine**, locale checks that halt execution on some CIS-region language settings, termination of services and remote management tools such as **ConnectWise** and **Kaseya**, deletion of shadow copies, and selective encryption exclusions. The FBI published indicators including infrastructure, IP addresses, Bitcoin wallets, and operator email addresses tied to access, command-and-control, and exfiltration activity, and urged organizations to report incidents, preserve artifacts, avoid ransom payments, and strengthen defenses with offline backups, MFA, patching, RDP hardening, least-privilege access, and network segmentation.
Aug 15, 2026
**LockerGoga** hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with **MegaCortex** in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as **Cobalt Strike** before encrypting systems. The malware appended the `.LOCKED` extension, dropped ransom notes such as `README_LOCKED.txt`, and in some cases was signed with a revoked **Sectigo** certificate issued to **ALISA LTD**, likely to reduce detection. Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and **MFA**, disable `SMBv1`, audit remote access and account creation, monitor **Active Directory** changes, and enable **PowerShell** logging to detect similar intrusions earlier.
Aug 15, 2026