Key Takeaways
- Gunra ransomware is a double‑extortion variant that exploits recent Schneider Electric and Fortinet vulnerabilities to gain initial access.
- The group targets critical sectors worldwide—healthcare, finance, government, and professional services—with most victims in South Korea, Brazil, Spain, Thailand, and Hong Kong, though its activity is concentrated in Australia, East Asia, and Europe.
- Gunra employs phishing, credential harvesting, lateral movement via Impacket tools, and timing attacks between 10 p.m. and 6 a.m. to evade detection, while deleting logs and backups to maximize impact.
- It operates as a Ransomware‑as‑a‑Service (RaaS) platform, offering Windows and Linux lockers, a management panel, and affiliate documentation, with affiliates receiving a share of ransom proceeds.
- A cryptographic flaw in the Linux build allows key recovery, and the group frequently rebrands (e.g., “Golden Community”) and recruits initial‑access brokers to expand its reach.
- Some tactics, techniques, and infrastructure overlap with suspected North Korean state‑sponsored campaigns, suggesting limited collaboration or tool sharing.
- Defensively, organizations should patch exposed systems, enforce network segmentation, maintain immutable offline backups, monitor for anomalous SMB/Impacket usage, and harden MFA and VPN configurations.
Overview
Cybersecurity and intelligence agencies from South Korea and the United States have issued a joint warning about the Gunra ransomware strain, which is being used to attack critical‑infrastructure sectors and organizations worldwide. The alert highlights that Gunra is part of the broader trend of ransomware campaigns causing operational disruption and financial harm, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) noting its increasing prevalence since its emergence in April 2025.
Targets & Impact
The ransomware’s victims span healthcare and public health, financial services, government facilities, and professional and nonprofit services. According to data collected by Ransomware.Live, Gunra has listed 51 victims to date, with the majority located in South Korea, Brazil, Spain, Thailand, and Hong Kong. Although only three victims have been reported from Canada and the United States, the group’s activity is concentrated in Australia, East Asia, and Europe, indicating a geographic focus beyond its initial victim pool.
Initial Access & Exploitation
Gunra gains footholds by exploiting two recently disclosed vulnerabilities: CVE‑2024‑5559 in Schneider Electric PowerLogic P5 devices and CVE‑2025‑24472 in Fortinet FortiOS and FortiProxy appliances. Attackers use these flaws to breach internet‑facing perimeter devices, then establish a foothold inside the victim network. Phishing remains the primary delivery mechanism for initial malware, often luring users with socially engineered emails that lead to credential theft or malicious payload execution.
Double‑Extortion Model
Once inside, Gunra follows a double‑extortion approach: it exfiltrates sensitive data before encrypting files. Victims who refuse to pay the ransom within a five‑to‑seven‑day window see their stolen information published on a leak site, increasing pressure to comply. The ransomware encrypts large volumes of data—up to 9 TB—using stream ciphers such as Salsa20 or ChaCha20, enabling rapid encryption of extensive file sets.
Technical Attack Chain
After initial compromise, Gunra leverages Impacket utilities for lateral movement. The “psexec.py” and “smbclient.py” modules facilitate SMB‑based remote command execution, while “secretsdump.py” extracts password hashes from NTDS.dit files on domain controllers. To conceal its activity, the group deletes system and network access logs, clears command histories, and conducts most malicious actions—including reconnaissance and data staging—between 10 p.m. and 6 a.m., when monitoring is often reduced.
Data Exfiltration & VDI Targeting
Exfiltration is performed via an executable named “main.exe,” which transfers harvested data to cloud storage services such as MEGA, often compressing terabytes of information into archives. Gunra also targets virtual desktop infrastructure (VDI) environments used by IT personnel, stealing session cookies and configuration files. In one observed case, attackers manipulated an SSL‑VPN appliance’s network‑traffic control to intercept authentication tokens, then hijacked user sessions to move laterally inside the network.
MFA Bypass & Privilege Escalation
To circumvent multi‑factor authentication, Gunra tampers with authentication processing files on the corporate VDI portal server, allowing a designated one‑time password (OTP) value to grant access. Additionally, the group exploits default or unused accounts on SSL‑VPN appliances, modifies their configuration to bypass mandatory password changes, and uses these accounts to maintain persistence. Privilege escalation is achieved by stealing symmetric encryption keys from Hiware system‑access‑control servers, enabling credential dumping of enterprise‑server passwords stored in databases.
Ransomware‑as‑a‑Service Structure
In January 2026, Gunra launched a formal RaaS program on dark‑web forums, offering affiliates a management panel, a configurable ransomware builder, cross‑platform locker payloads (Windows and Linux), and detailed documentation. Affiliates receive a portion of the ransom proceeds in exchange for providing initial access—often recruited from penetration testers or ethical hackers acting as initial‑access brokers. The FBI has observed the group rebranding its operation under aliases such as “Golden Community” to broaden its appeal and evade attribution.
Cryptographic Weakness & Linux Variant
An analysis by Breakglass Intelligence in March 2026 identified a “catastrophic cryptographic weakness” in the Linux builds of Gunra’s locker, permitting recovery of the encryption key and thus enabling victims to restore files without paying the ransom. This flaw underscores the importance of scrutinizing ransomware binaries for implementation errors, even when the underlying algorithm (e.g., Salsa20/ChaCha20) is theoretically strong.
Possible Collaboration with State‑Sponsored Actors
The warning notes similarities between Gunra’s tactics and a recent South Korean advisory concerning an unspecified state‑sponsored threat group active from 2025 through mid‑2026. Both campaigns have exploited the same financial‑software vulnerabilities, used spear‑phishing and watering‑hole techniques, and distributed malware families such as Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE)—tools associated with the Lazarus Group. Analysts from AhnLab suggest that while the groups may have distinct objectives, they likely shared certain tools, infrastructure, or engaged in limited collaboration during the attacks. Historical precedents, such as Lazarus sub‑cluster Andariel partnering with the Play ransomware crew in 2024, support the notion of North‑Korean‑linked actors providing resources to ransomware operators.
Mitigation Recommendations
To defend against Gunra, organizations should:
- Apply patches promptly for all internet‑facing systems, prioritizing CVE‑2024‑5559 (Schneider Electric) and CVE‑2025‑24472 (Fortinet).
- Enforce network segmentation to limit lateral movement, especially restricting SMB and Impacket tool usage between zones.
- Maintain immutable, offline backups stored in a separate physical location and test restoration procedures regularly.
- Monitor for abnormal authentication patterns, unauthorized OTP acceptance, and unusual activity during off‑hours (10 p.m.–6 a.m.).
- Harden VPN and VDI appliances by disabling default credentials, enforcing strict password policies, and reviewing account configurations for unnecessary privileges.
- Deploy endpoint detection and response (EDR) solutions capable of detecting Impacket‑based command execution, credential dumping, and large‑scale data exfiltration to cloud services.
- Educate users on phishing awareness and implement multi‑factor authentication that resists replay or OTP‑tampering attempts.
By adopting these controls, organizations can reduce the attack surface that Gunra exploits and improve resilience against its double‑extortion tactics.