Gunra Ransomware: US and South Korea Issue Joint Global Advisory

In a coordinated intelligence action highlighting the growing convergence of operational technology (OT) vulnerabilities and enterprise extortion, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), the United States Secret Service (USSS), the Department of Defense Cyber Crime Center (DC3), and South Korea’s National Police Agency (KNPA) released an urgent joint cybersecurity advisory on August 11, 2026. The advisory warns of a rapidly escalating global extortion campaign orchestrated by operators deploying Gunra ransomware. Combining high-speed multi-threaded encryption with systematic data exfiltration, the group has aggressively targeted critical infrastructure, healthcare systems, financial institutions, government facilities, and logistics networks across North America, Europe, South America, and the Asia-Pacific region. Organizations across the globe are being urged to institute immediate perimeter hardening and immutable logging controls as the group accelerates its extortion cadence.

The Genesis and Evolution of Gunra Ransomware

First detected in the wild in April 2025, Gunra ransomware represents a direct evolution of the high-impact ransomware syndicates that dominated the cybercrime landscape over the past decade. Technical analysis of early Gunra samples reveals heavy code inheritance from the source code of the infamous Conti ransomware, which was leaked online in 2022 following internal group disruption. Rather than merely recycling legacy tools, Gunra’s core developers refactored the codebase to create an optimized, modular strain focused on rapid execution, cross-platform adaptability, and streamlined victim coercion.

In January 2026, the threat actors behind Gunra formally transitioned their operation into a structured Ransomware-as-a-Service (RaaS) model. The core developers initiated aggressive recruitment campaigns on premier Russian-language dark web forums, offering seasoned affiliates generous revenue-sharing splits. Intelligence gathered by joint law enforcement agencies indicates that Gunra has also engaged in tactical infrastructure-sharing agreements with established advanced persistent threat (APT) units, including components linked to North Korea’s Lazarus Group, to facilitate initial network breaches in East Asia. This shift to a RaaS ecosystem has driven a dramatic surge in operational velocity, with over 51 major enterprise breaches recorded on the group’s Dedicated Leak Site (DLS).

Initial Access Vectors: Exploiting Network Perimeter Flaws

Gunra affiliates rely on a hybrid initial access architecture that pairs sophisticated human-targeted social engineering with automated, mass-scale exploitation of vulnerable edge appliances. While spear-phishing campaigns delivering custom loaders remain an active entry mechanism, recent incident response investigations highlight an overwhelming reliance on public-facing perimeter infrastructure.

Specifically, the joint advisory highlights active exploitation of two key vulnerabilities:

• Schneider Electric PowerLogic P5 Devices (CVE-2024-5559): Threat actors exploit security flaws within these internet-facing power protection relays to gain direct foothold within industrial control systems (ICS) and operational technology (OT) environments, bridging the gap between physical infrastructure control and enterprise IT networks.
• Fortinet FortiOS and FortiProxy Appliances (CVE-2025-24472 / CVE-2024-55591): Attackers actively target an authentication bypass vulnerability within Fortinet’s Security Fabric proxy architecture. By sending specially crafted requests to the appliance, unauthenticated remote adversaries bypass credentials and obtain super-administrator privileges on targeted devices. This access enables affiliates to modify network routing, disable security logging, and establish persistent Virtual Private Network (VPN) tunnels directly into internal corporate subnets.

Once perimeter appliances are compromised, operators utilize built-in administrative tools and stolen VPN tokens to establish encrypted command-and-control (C2) channels, setting the stage for rapid internal lateral movement.

Internal Reconnaissance and Anti-Forensic Evasion

Upon establishing a beachhead, Gunra operators move swiftly to compromise Active Directory domain controllers, map out network topologies, and identify core storage repositories. To maximize operational stealth during the intrusion lifecycle, the malware and its human operators employ aggressive anti-forensic techniques designed to impede digital forensics and incident response (DFIR) teams.

Key defense evasion capabilities deployed by Gunra affiliates include:

• Real-Time Log Destruction: Operators systematically clear bash and command history files (executing history -c commands on Linux systems) and force-wipe Windows Event Logs using PowerShell scripts to obscure lateral movement artifacts.
• Targeted Access Log Erasure: The ransomware actively targets and deletes network access logs, administrative audit trails, and authentication records while remaining persistently connected to the victim network.
• Shadow Copy and Recovery Sabotage: Prior to payload execution, the binary invokes vssadmin.exe delete shadows /all /quiet and modifies boot configuration settings to disable automatic repair, ensuring system restoration from local shadow copies is rendered impossible.
• Security Process Termination: Gunra incorporates an extensive process termination list, terminating Endpoint Detection and Response (EDR) agents, database services (such as SQL Server and Oracle), and backup management applications to unlock files for full encryption.

Technical Cryptographic Architecture and Exfiltration Engine

Gunra’s encryption payload is engineered for maximum throughput, allowing threat actors to paralyze enterprise storage arrays before security operations center (SOC) analysts can intervene. The malware is compiled for both Windows Portable Executable (PE) and Linux Executable and Linkable Format (ELF) environments, demonstrating a modern cross-platform engineering philosophy.

The technical engine behind Gunra relies on a high-performance hybrid cryptographic structure:

• Salsa20 and ChaCha20 Stream Ciphers: Depending on the variant and target environment, Gunra utilizes advanced stream ciphers (Salsa20 or ChaCha20) to perform symmetric file encryption. These ciphers leverage CPU SIMD instructions to achieve blinding execution speeds.
• Multi-Threaded Execution Engine: The Linux ELF variant supports highly granular command-line arguments (such as --threads, --ratio, and --path), allowing attackers to spawn up to 100 parallel encryption threads simultaneously. This capability enables Gunra to fully encrypt multi-terabyte environments—including massive 9-terabyte virtual machine datastores—in a fraction of the time required by traditional ciphers.
• Partial Encryption Logic: To optimize speed on large files, Gunra supports partial encryption modes, corrupting critical file headers and sparse data blocks rather than processing the entire file byte-by-byte.
• Asymmetric Key Protection: The generated symmetric keys are immediately encrypted using a hardcoded RSA-4096 public key and appended to the tail of each encrypted file or exported to an isolated keystore, making file recovery mathematically impossible without the attacker’s private key.

Crucially, Gunra operators complete large-scale exfiltration of proprietary documents, employee records, financial ledgers, and intellectual property prior to invoking the encryption routine. Using custom staging scripts and commercial cloud storage utilities, gigabytes or terabytes of data are quietly funneled to attacker-controlled infrastructure.

Double-Extortion Mechanics and the WhatsApp-Themed Negotiation Panel

Gunra operates a strict double-extortion operational model that leverages both business disruption and public exposure to force compliance. Once encryption is finalized, ransom notes are dropped across directories, directing victimized leadership to initiate contact via a specialized Tor-based negotiation portal.

A unique hallmark of Gunra’s operational security is its customized communication infrastructure. Victims who access the onion-routed payment site are redirected to an interactive chat interface designed with a distinct WhatsApp-themed visual panel. This interface provides automated countdown timers, file proof-of-decapitation options, and direct messaging functionality with Gunra extortion specialists.

The extortion playbook employed by Gunra features several high-pressure tactics:

1. Short Ultimatums: Victims are given a strict window of 5 to 7 days to open negotiations and fulfill financial demands.
2. Aggressive C-Suite Outreach: In cases where organizations refuse to engage on the Tor panel, Gunra actors initiate direct email outreach to corporate executives, management staff, and board members to create internal panic and demand payment.
3. Eight-Figure Demands: Financial demands regularly exceed $10 million USD in cryptocurrency (typically Bitcoin or Monero), scaled according to the victim’s perceived revenue.
4. Dedicated Leak Site (DLS) Publishing: Non-compliant victims have their sensitive data published in tranches or put up for sale to dark web buyers on Gunra’s public DLS site.

Comprehensive Defense and Mitigation Framework against Gunra Ransomware

To defend against the sophisticated capabilities of Gunra ransomware, CISA, the FBI, and South Korea’s National Police Agency urge cybersecurity teams, system administrators, and executive leadership to implement an immediate multi-layered defense strategy.

Organizations must prioritize the following mitigation actions:

• Immediate Edge Patching: Prioritize emergency patching for external-facing network devices, specifically applying vendor updates for Schneider Electric PowerLogic P5 devices (CVE-2024-5559) and Fortinet FortiOS/FortiProxy appliances (CVE-2025-24472 / CVE-2024-55591). If patching cannot be executed immediately, disable HTTP/HTTPS administrative interfaces exposed to the public internet.
• Phishing-