Gunra ransomware emerged in April 2025 as a sophisticated double-extortion malware variant based on leaked Conti ransomware source code. It targets government and critical infrastructure sectors globally. The group exploits two critical authentication vulnerabilities in Fortinet FortiOS and FortiProxy (CVE-2024-55591 and CVE-2025-24472) and abuses credential exposure and SSH access control flaws in internet-facing VPN gateways to gain initial access. Initially focused on Windows, Gunra expanded to cross-platform attacks with a Linux variant introduced mid-2025. Since January 2026, Gunra launched a ransomware-as-a-service (RaaS) platform with affiliate management tools and actively recruits initial access brokers, including penetration testers and ethical hackers, to expand operations. The group also uses aliases such as Golden Community. The ransomware actors attempt direct ransom negotiations with victim management via email but with limited success. South Korean cybersecurity research links Gunra to the North Korean state-backed Lazarus Group.

Gunra ransomware poses a significant threat to government and critical infrastructure organizations worldwide by encrypting data and threatening data exposure through double-extortion tactics. Exploitation of critical vulnerabilities in widely deployed Fortinet firewall and proxy products, as well as VPN gateway security flaws, enables attackers to gain network footholds. The ransomware's cross-platform capabilities increase its attack surface. The establishment of a RaaS platform and recruitment of affiliates and initial access brokers facilitate broader and more scalable attacks. The association with a state-backed threat actor increases the potential for sophisticated and persistent campaigns.

The U.S. and South Korean advisory recommends immediate patching of the known exploited vulnerabilities CVE-2024-55591 and CVE-2025-24472 in Fortinet FortiOS and FortiProxy products. Organizations should also patch VPN gateway vulnerabilities that allow credential exposure and SSH access abuse. Network segmentation is advised to limit lateral movement within compromised environments. Maintaining offline backups of critical data is essential to enable recovery without paying ransom. No official fix or patch is provided for the ransomware itself, but patching exploited vulnerabilities and following recommended defensive measures reduce risk. The advisory does not state that the threat is already mitigated or that no action is required.