Gunra Ransomware: 8 Things to Know After the FBI’s August 2026 Advisory
Tabla de contenido
On August 10, the FBI, CISA, NSA, U.S. Secret Service, and South Korea’s National Police Agency published a joint advisory on Gunra ransomware. Here are the eight things you need to know.
1. Gunra is built on leaked Conti source code and has been running since April 2025
Gunra first appeared in April 2025 as a double-extortion ransomware variant derived from the Conti source code that leaked in 2022. It is not the first group to build on Conti’s leaked source code. Black Basta, BlackByte, and several others have done the same. But Gunra has moved faster than most from initial emergence to structured criminal enterprise. By January 2026, less than nine months after its first observed attacks, the group had launched a formal ransomware-as-a-service affiliate program on dark web forums, complete with a management panel, a configurable ransomware builder, cross-platform locker payloads for both Windows and Linux, and structured affiliate documentation. The group also operates under the alias Golden Community, which it uses for recruitment and branding in underground communities.
2. They recruit ethical hackers and penetration testers as paid initial access brokers
The FBI’s advisory notes that Gunra actively recruits penetration testers and ethical hackers to serve as initial access brokers, offering a share of ransom profits in exchange for enterprise network access. This is not unusual in the RaaS ecosystem, but Gunra’s explicit targeting of people with legitimate security credentials is worth noting. The group’s recruitment pitch is effectively: use the skills you developed for defensive work to identify and sell access to corporate networks. The financial incentive is a percentage of ransoms that routinely run into millions of dollars. The advisory does not specify the affiliate split, but Conti-derived operations have historically offered affiliates between 70% and 80% of ransom proceeds, making Gunra’s program among the most financially attractive in the criminal market.
3. Their entry point is two Fortinet vulnerabilities that are eighteen months old
Gunra’s primary initial access technique is exploitation of CVE-2024-55591 and CVE-2025-24472, both authentication bypass vulnerabilities affecting specific versions of Fortinet FortiOS and FortiProxy. CVE-2024-55591 allows a remote attacker to gain super-admin privileges via crafted requests to the Node.js websocket module. CVE-2025-24472 allows a remote unauthenticated attacker with knowledge of upstream and downstream devices to bypass authentication controls. Both vulnerabilities have been patched, publicly documented, and exploited by multiple other ransomware groups before Gunra adopted them. The FBI has also observed Gunra gaining access to administrator accounts for SSL-VPN appliances by exploiting default credentials when account lockout controls were not present. The lesson here is that Gunra does not need novel techniques. It needs unpatched appliances, and there are enough of them to sustain a fifty-one-victim leak site across seventeen months of operation.
4. They modified the VPN authentication flow to install their own backdoor OTP
South Korea’s National Police Agency documented one of the most operationally sophisticated techniques in the advisory: Gunra actors tampered with authentication processing files on a corporate VDI authentication portal server so that successful authentication occurred when a specific Gunra-designated one-time password value was entered. In the same environment, the group manipulated the SSL-VPN appliance’s network traffic control functionality to intercept credentials and session information transmitted by users authenticating to the portal. Those stolen session cookies were then used to conduct session hijacking and impersonate legitimate users to gain access to the internal network. This is not a simple credential stuffing attack. It is a persistent modification of the authentication infrastructure that continues to work regardless of how many times legitimate users rotate their passwords.
5. They delete backups at both the primary data center and the disaster recovery site before encrypting
El CISA advisory documents Gunra actors deleting backup and archived data stored on backup infrastructure at both the primary data center and the disaster recovery center before and after ransomware deployment. This is the step that converts a ransomware attack from an inconvenience into a catastrophe. Organizations with tested, immutable, offline backups can recover without paying. Organizations whose disaster recovery infrastructure is reachable from the same network the attacker has already compromised cannot. The advisory recommends implementing offline, immutable backups stored in a physically separate, segmented location. The reason that recommendation exists is that online backups connected to the same network are the first thing Gunra deletes.
6. They operate between 10 p.m. and 6 a.m. and delete logs before leaving
Gunra primarily conducts malicious activities and internal infrastructure reconnaissance between 10 p.m. and 6 a.m. local time at victim organizations. After each session, the group deletes system and network access logs and clears command history. This operating pattern reflects a deliberate approach to minimizing detection. Most enterprise security teams operate during business hours, and automated alerting thresholds are often set for daytime traffic baselines. Working overnight and cleaning up afterward means that by the time anyone reviews the previous night’s activity, the relevant logs no longer exist. The group also uses Impacket libraries including psexec.py, smbclient.py, and secretsdump.py for lateral movement and credential dumping against compromised domain controllers, extracting password hashes from the NTDS file. These are well-documented tools that standard endpoint detection should catch, but Gunra uses PhantomKiller-style EDR evasion to disable security software before running them.
7. Their Linux encryptor has a catastrophic cryptographic flaw that lets victims recover files without paying
In March 2026, Breakglass Intelligence published an analysis identifying a cryptographic weakness in Gunra’s Linux variant. The group seeds its random number generator with the system time, making the encryption key recoverable if defenders can reconstruct the key using file timestamps. The advisory notes this flaw, describing it as a weakness that allows defenders to recover files without paying the ransom. This is a rare and operationally significant finding. Most ransomware groups invest heavily in ensuring that their encryption is cryptographically sound precisely because an exploitable weakness undermines the entire business model. Gunra’s Linux flaw means that any organization running Linux systems that was encrypted by Gunra should engage an incident response firm with knowledge of the Breakglass recovery procedure before making any ransom payment decisions. The Windows variant does not appear to share this weakness, but Linux servers, including the database servers and NAS systems Gunra specifically targets, are recoverable.
8. Lazarus Group infrastructure and tools overlap with Gunra’s South Korean campaigns
AhnLab’s analysis of Gunra’s South Korean campaigns identified payloads including Struggle (also known as SIGNBT 3.0) and Brandoor (also known as COPPERHEDGE), both of which are attributed to the Lazarus Group. The advisory notes that while the state-sponsored threat group and Gunra appear to be separate threat actors with different ultimate objectives, they may have shared techniques, tools, and infrastructure, or collaborated to a limited extent during attacks. AhnLab’s analysis of Gunra’s South Korean campaigns identified these Lazarus-linked payloads. This collaboration pattern is not unprecedented. Palo Alto Networks Unit 42 documented Lazarus sub-cluster Andariel partnering with the Play ransomware crew in October 2024, and Lazarus and Moonstone Sleet have been linked to Qilin and Medusa ransomware attacks since at least September 2025. The implication for incident responders is that a Gunra ransomware attack in South Korea or adjacent sectors should be investigated with the assumption that the initial access or tooling may have involved North Korean state infrastructure, which changes both the attribution analysis and the scope of what may have been exfiltrated before the ransomware was deployed.
CybelAngel monitors internet-exposed Fortinet appliances, leaked credentials, and dark web forum activity for indicators connected to Gunra and similar RaaS operations across the external attack surfaces of its clients. If your perimeter appliances are reachable from the internet and running unpatched FortiOS or FortiProxy versions, the entry point Gunra uses is already available to them.
Sobre el autor
