Home › Threat Actors › Gunra
← All Threat Actors
Cybercrime critical Not attributed to a specific nation-state. Conti-derived code (the Conti source code leaked in February 2022 per the advisory).

Gunra

Ransomware-as-a-Service (RaaS) operation with encryptor codebase showing clear Conti lineage, consistent with the broader wave of post-Conti successor groups since the 2022 Conti source leak. Subject of a joint advisory (AA26-222A, August 2026) from CISA, FBI, NSA, US Secret Service, and South Korea's National Police Agency. · Financial — double extortion (data exfiltration before encryption, with publication threats on a dedicated leak site if ransom is unpaid). Advisory notes payment has not consistently resulted in decryptor delivery.

Reports 1
Active Since April 2025 (private operation), transitioned to a formal affiliate-recruiting RaaS model in early 2026
Last Reported 12 Aug 2026
Sectors Targeted healthcare, finance, government, critical-infrastructure, manufacturing, transport, academia, media, communications

Tactics, Techniques & Procedures (TTPs)

  • Initial access via exploitation of two Fortinet SSL-VPN/web-management authentication-bypass flaws: CVE-2024-55591 and CVE-2025-24472 (FortiOS/FortiProxy), enabling unauthenticated super-admin access or rogue admin account creation
  • Persistence via modified/rogue admin accounts and scheduled tasks
  • Data staging/exfiltration prior to encryption, double-extortion leak site, Tor-based negotiation portal with countdown timers
  • Recruits pentesters and ethical hackers as initial access brokers, paying a share of ransom profits (BleepingComputer)
  • Emails victim management directly, with limited success; victims get 5 to 7 days to pay (The Record)
  • Advisory also cites credential-exposure and SSH access-control flaws in internet-facing VPN gateways
  • RaaS management panel, configurable builder and cross-platform lockers; Linux variant appeared in mid-2025
  • Internal reconnaissance with built-in Windows tooling; lateral movement via RDP and SMB (BloodHound and a three-week dwell time in earlier text were not confirmed in the pages reviewed)

Known Targets

Healthcare and public healthFinancial services and insuranceGovernment services and facilitiesCritical manufacturing and constructionTransportation systems and logisticsUtilitiesAcademiaMedia and communicationsRetailIndustrial organisations: Dragos counted at least 8 Gunra attacks in Q1 2026 and at least 4 in Q2 2026 (The Record, single source)South Korean organisations (AhnLab ASEC)

Analyst Notes

Merged from two advisory briefings on the same joint advisory (AA26-222A). At least 51 confirmed attacks attributed to Gunra affiliates as of the advisory. Caveat per Breakglass Intelligence research cited alongside the advisory: Gunra's LINUX encryptor contains a cryptographic implementation flaw that allows files to be recovered without paying for a decryptor — organizations with Linux systems encrypted by Gunra should get specialist IR involved before any ransom decision. Update (research pass): Ransom demands the FBI reviewed were often over $10M. AhnLab ASEC's "Operation Double Barrel" (30 July 2026) found technical overlaps between Gunra and a North Korean state group widely tracked as Lazarus (matching filenames, execution arguments, privilege-escalation tools, C2 servers, an SSH key fingerprint and the same file-deletion routine; both exploited the same flaws in Korean financial security software). AhnLab did not say they are the same actor and cited possible collaboration, shared infrastructure or a common access broker; the profiles are therefore not merged. The Linux flaw is a key-generation weakness that lets defenders recover files from timestamps (found March 2026 per The Record). Not confirmed from reviewed pages: "at least 51 attacks" and a CVE-2024-5559 mention in one search summary.

Also Known As

Golden Community (branding alias observed by the FBI)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1486 Data Encrypted for Impact T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares

Intelligence Reports

Briefing healthcarefinance

Gunra Ransomware: Five-Agency Advisory Flags Fortinet-Backed RaaS Targeting Healthcare and Critical Infrastructure

A joint advisory from CISA, FBI, NSA, US Secret Service, and South Korea's NPA attributes 51+ attacks to Gunra, a Conti-derived ransomware-as-a-service operation exploiting two Fortinet authentication bypass vulnerabilities for initial access.

12 Aug 2026 · 4 min read