MalwarePublished 11 Aug 2026

US and South Korea warn of Gunra ransomware targeting govt agencies

Source Bleeping Computer

Mentions 2 CVEs

Mentioned vulnerabilities

ransomware

Description

U.S. federal agencies and South Korea's National Policy Agency issued a joint advisory warning government and critical infrastructure organizations worldwide about Gunra ransomware attacks. Gunra is a double-extortion ransomware variant derived from leaked Conti ransomware source code. It targets multiple sectors including healthcare, finance, and government services. The group exploits known vulnerabilities in Fortinet firewalls and VPN gateways to gain network access. Since early 2026, Gunra operates a ransomware-as-a-service platform, recruiting affiliates and initial access brokers. The advisory recommends patching exploited vulnerabilities, network segmentation, and offline backups to mitigate risk.

Impact

Gunra ransomware poses a significant threat to government and critical infrastructure organizations worldwide by encrypting data and threatening data exposure through double-extortion tactics. Exploitation of critical vulnerabilities in widely deployed Fortinet firewall and proxy products, as well as VPN gateway security flaws, enables attackers to gain network footholds. The ransomware's cross-platform capabilities increase its attack surface. The establishment of a RaaS platform and recruitment of affiliates and initial access brokers facilitate broader and more scalable attacks. The association with a state-backed threat actor increases the potential for sophisticated and persistent campaigns.

Defensive guidance

The U.S. and South Korean advisory recommends immediate patching of the known exploited vulnerabilities CVE-2024-55591 and CVE-2025-24472 in Fortinet FortiOS and FortiProxy products. Organizations should also patch VPN gateway vulnerabilities that allow credential exposure and SSH access abuse. Network segmentation is advised to limit lateral movement within compromised environments. Maintaining offline backups of critical data is essential to enable recovery without paying ransom. The advisory does not state that the threat is already mitigated or that no action is required.

Summary

Gunra ransomware emerged in April 2025 as a sophisticated double-extortion malware variant based on leaked Conti ransomware source code. It targets government and critical infrastructure sectors globally. The group exploits two critical authentication vulnerabilities in Fortinet FortiOS and FortiProxy (CVE-2024-55591 and CVE-2025-24472) and abuses credential exposure and SSH access control flaws in internet-facing VPN gateways to gain initial access. Initially focused on Windows, Gunra expanded to cross-platform attacks with a Linux variant introduced mid-2025. Since January 2026, Gunra launched a ransomware-as-a-service (RaaS) platform with affiliate management tools and actively recruits initial access brokers, including penetration testers and ethical hackers, to expand operations. The group also uses aliases such as Golden Community. The ransomware actors attempt direct ransom negotiations with victim management via email but with limited success. South Korean cybersecurity research links Gunra to the North Korean state-backed Lazarus Group.

References

bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Aug 2026, 10:11 UTC

References

Community reviews

Related threats