Six US and South Korean government agencies jointly warned Monday that Gunra, a ransomware-as-a-service operation built on leaked code from the notorious Conti gang, has struck at least 51 organizations across the Americas, Europe, the Middle East, Africa, and the Asia-Pacific — breaching hospitals, government agencies, and financial institutions by exploiting unpatched Fortinet firewall products and demanding ransoms that in most documented cases exceeded $10 million. The advisory, designated CISA advisory AA26-222A under CISA’s ongoing #StopRansomware initiative, carries an unusual second piece of intelligence that network defenders should act on immediately: researchers at Breakglass Intelligence confirmed in March 2026 that Gunra’s Linux-specific ransomware builds contain a fatal cryptographic error that allows victims whose Linux systems were encrypted to recover their files without paying the ransom — a finding detailed in Breakglass Intelligence’s March 2026 analysis.
How Gunra Entered 51 Networks: Unpatched Fortinet Appliances and Default Credentials
The most urgent finding in advisory AA26-222A concerns the entry point: Gunra actors gained access primarily by exploiting two authentication-bypass vulnerabilities — CVE-2024-55591 and CVE-2025-24472 — in Fortinet’s FortiOS and FortiProxy products. Both flaws are classified under CWE-288, a category of design-level authentication failure, and both carry CISA Known Exploited Vulnerabilities catalog entries confirming real-world exploitation against live targets. CVE-2024-55591 received a CVSS score of 9.6 (Critical) and was disclosed by Fortinet in January 2025 after being exploited in the wild as a zero-day since at least mid-November 2024; CVE-2025-24472 received a score of 8.1 (High) and was added to Fortinet’s advisory in February 2025, as detailed in Tenable’s analysis of both vulnerabilities. Patches for both vulnerabilities have been available since early 2025 — organizations running affected FortiOS or FortiProxy versions that have not yet applied them are actively exposed to the initial access technique Gunra used against most of its documented victims.
The agencies documented additional entry paths beyond the Fortinet flaws. In one incident, Gunra actors accessed an SSL-VPN administrative account protected only by default credentials, then downloaded OpenSSH from an attacker-controlled server to establish persistent access. In another case documented by South Korea’s National Police Agency (KNPA), the attackers manipulated the network traffic-control functionality of an SSL-VPN appliance to intercept credentials and session cookies belonging to legitimate users, then used those cookies to impersonate employees and move through the internal network as if they belonged there.
Inside the Attack: How Gunra Defeats MFA and Deletes Every Backup It Can Find
Once inside, Gunra actors did not leave multi-factor authentication alone. The advisory documented a specific technique in which the group modified authentication processing files on a corporate virtual desktop infrastructure (VDI) authentication portal server to accept a specific, Gunra-designated one-time password value, effectively building a secret backdoor into the MFA system. This is not a brute-force attack against MFA — it is a surgical modification of the authentication logic itself that persists until an administrator audits and reverses the change.
Lateral movement relied on Impacket libraries: the group used psexec.py, smbclient.py, and secretsdump.py to move across victim networks via the SMB protocol and dump credential hashes from domain controllers’ NTDS databases. With those harvested hashes, Gunra operators escalated privileges across the environment without needing plaintext passwords.
Before deploying the ransomware payload, Gunra specifically targeted and deleted both primary backups and disaster recovery backups — the single most damaging element of the group’s playbook for any organization that might otherwise have recovered without paying. Exfiltration preceded encryption: stolen data was funneled through a tool called main.exe via Microsoft OneDrive and SharePoint, and in several cases attackers compressed terabytes of data into archives and routed them to the MEGA file-sharing service. The group has demonstrated the ability to encrypt up to 9 terabytes (TB) of data in a limited timeframe using ChaCha20 and Salsa20 stream ciphers chosen for encryption speed at scale, according to The Hacker News’s technical analysis of the advisory.
Most intrusion activity occurred between 10 p.m. and 6 a.m. to reduce the likelihood of detection during business hours.
What You Need to Know If Your Linux Systems Were Encrypted
Gunra initially targeted only Windows environments, then introduced a Linux encryptor variant in mid-2025. That expansion came with a critical implementation error that defenders can exploit.
Researchers at Breakglass Intelligence disclosed in March 2026 that Gunra’s Linux builds generate ChaCha20 encryption key material using musl-libc’s rand() function seeded by time(), as documented in the Breakglass Intelligence Linux encryptor analysis — the Unix timestamp in seconds. This is a Linear Congruential Generator producing only 15-bit output values, which means the effective cryptographic keyspace for any given second of encryption activity is approximately 256 possible seed values. For a realistic one-hour encryption window, there are only about 3,600 seed values to test — a number trivially small for any modern computer.
The Windows variant uses Windows’ CryptGenRandom() function, which is cryptographically secure, and is not affected by this weakness. Only files encrypted by the Linux variant, which receive the .GNRA file extension, are recoverable through this method.
The CISA advisory specifically notes this finding and directs incident responders to preserve encrypted files, file timestamps, ransom notes, and system logs from any Gunra Linux compromise before taking any other remediation action. File timestamps are the key to reconstruction: the mtime and ctime values on .GNRA files narrow the seed search window and make recovery practical. If you have already rebooted or modified encrypted Linux files without preserving timestamps, contact an incident response firm before concluding that recovery is impossible.
The Windows-encrypted files (.ENCRT extension) cannot be recovered through this method.
What Makes Gunra a New Threat, and What Makes It the Same Old Problem?
Gunra is not a novel ransomware family in the sense of introducing new cryptographic primitives or previously unseen attack techniques. It is a direct descendant of the Conti ransomware operation, built on source code that a Ukrainian researcher publicly leaked in March 2022 after the Conti gang declared its support for Russia following the invasion of Ukraine. That leak — approximately 60,000 internal chat messages and full source code, documented by BleepingComputer at the time — has since served as the foundation for multiple derivative criminal operations, of which Gunra is among the most capable to emerge.
The implication is one the advisory does not state explicitly but that the Conti lineage makes clear: disrupting Gunra will not close the underlying code repository that produced it. The same open-source criminal toolkit has already generated Gunra and other descendants; it will continue to generate new groups after Gunra is disrupted, until law enforcement actions or defender improvements make the underlying attack techniques uneconomical rather than merely interrupting a single operation.
Gunra appeared in April 2025 as a Windows-only double-extortion operation and spent its first year developing capability and claiming victims before launching a structured ransomware-as-a-service (RaaS) affiliate program on dark web forums in January 2026, per Breakglass Intelligence’s operational profile. In the RaaS model, the core operators maintain the platform — the management panel, the ransomware builder, the cross-platform encryptors, the dedicated leak site infrastructure — while financially motivated affiliates conduct intrusions, pay the operators a cut of any ransom received, and retain the rest. The FBI observed the group operating under the branding alias “Golden Community” as it expanded and actively recruited penetration testers and ethical hackers to serve as initial access brokers.
Scale Is Rising: 1,140 Industrial Ransomware Incidents in a Single Quarter
The advisory arrives as ransomware targeting industrial and critical infrastructure organizations reached documented record levels. Cybersecurity firm Dragos identified 1,140 ransomware incidents affecting industrial organizations globally in the second quarter of 2026, a 12% increase over the 1,020 incidents recorded in the first quarter. At least four of those Q2 incidents were attributed to Gunra, following eight in Q1 — a pace that suggests the group is specifically accelerating against industrial targets.
“Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to US and international organizations,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity, as reported by The Record.
Dragos noted that none of its Q2 cases involved ransomware operators directly manipulating industrial control systems — but that encryption of enterprise IT and virtualization infrastructure routinely cascades into operational disruptions, precautionary shutdowns, and loss of visibility in industrial environments even without any ICS-native capability from the attackers.
What Documents the North Korea Connection
The advisory disclosed that some incidents involving Gunra ransomware overlapped with a separate cyber campaign attributed to an unspecified state-sponsored threat group. South Korean security firm AhnLab assessed that payloads from that campaign included Struggle (also known as SIGNBT 3.0) and Brandoor (also known as COPPERHEDGE) — both malware families documented as instruments of North Korea’s Lazarus Group, as covered in TechTimes’s Operation Double Barrel report.
AhnLab assessed a “likely technical link” between the two operator sets based on shared attack infrastructure — identical SSH key fingerprints, the same reverse-tunneling address, and the same file distribution domain appearing in both campaigns — but explicitly declined to conclude that the same command structure controlled both operations. The evidence is consistent with several explanations: shared tools, a common access broker, or limited collaboration between a state-sponsored espionage group and a financially motivated criminal operation.
This is consistent with a documented broader pattern. Palo Alto Networks Unit 42 attributed Andariel to Play ransomware collaboration in a prior report on Lazarus sub-cluster activity; more recently, the Lazarus Group and its related cluster Moonstone Sleet have been associated with Qilin and Medusa ransomware deployments. The North Korea connection should be understood as a documented infrastructure overlap rather than proof of unified command.
What Organizations Should Do Now
The joint advisory identifies several immediate defensive priorities:
Patch internet-facing systems immediately. Apply Fortinet’s available fixes for CVE-2024-55591 and CVE-2025-24472. Audit all internet-facing VPN gateways, firewalls, remote desktop protocol (RDP) infrastructure, and remote management interfaces for exposure and patch status.
Revoke and rotate credentials. Eliminate default administrative accounts. Revoke any credentials that may have been exposed to compromised systems and rotate service account passwords across the environment.
Protect and isolate backups. Ensure backup infrastructure is immutable and stored at a physically separate location isolated from the primary network — Gunra specifically locates and deletes backup systems before deploying its encryptor.
Audit MFA integrity. VDI and authentication portal systems should be audited for unauthorized modifications to authentication processing files. The technique Gunra used — modifying portal files to accept an attacker-controlled one-time password — leaves artifacts that identity and access management audits can detect.
Enforce network segmentation. Limit lateral movement opportunities within the environment to reduce the blast radius of any intrusion.
Enhance off-hours monitoring. Gunra consistently operated between 10 p.m. and 6 a.m. ET; enhanced monitoring and alerting during that window is warranted.
If Linux systems were encrypted: Do not reboot or modify encrypted files. Preserve all .GNRA file timestamps. Contact an incident response firm with the specific knowledge that file recovery without paying may be possible due to the weak random number generator in Gunra’s Linux builds. Do not pay ransom on Linux-encrypted files before exhausting this recovery option.
The full advisory, including downloadable indicators of compromise in STIX format, MITRE ATT&CK mappings, and detection guidance, is available on the CISA advisory page.
Frequently Asked Questions
Can Linux files encrypted by Gunra ransomware be recovered without paying the ransom?
Potentially yes — if the Linux variant (.GNRA extension) was used and file timestamps were preserved. Breakglass Intelligence confirmed in March 2026 that Gunra’s Linux builds use a cryptographically weak random number generator, as detailed in the Breakglass Intelligence encryptor flaw analysis (musl-libc’s rand() function seeded by the Unix timestamp), which reduces the effective keyspace to approximately 256 possible seed values per second of encryption. An incident responder can brute-force the seed using file timestamps to derive the encryption key and recover files. The CISA advisory specifically directs organizations with potential Linux Gunra infections to preserve encrypted files and timestamps before any other remediation action. The Windows variant (.ENCRT extension) uses a cryptographically secure generator and is not recoverable through this method.
What Fortinet vulnerabilities is Gunra exploiting, and are patches available?
Gunra exploited CVE-2024-55591 (CVSS 9.6, Critical) and CVE-2025-24472 (CVSS 8.1, High) — both authentication-bypass flaws in Fortinet’s FortiOS and FortiProxy products that allow an unauthenticated remote attacker to gain super-administrator privileges on affected devices. Patches for both have been available since early 2025. Both vulnerabilities are confirmed on CISA’s Known Exploited Vulnerabilities catalog, meaning they are confirmed to have been used in real attacks. Organizations running affected versions of FortiOS or FortiProxy should patch immediately; if patching is not immediately possible, CISA recommends disabling the HTTP/HTTPS administrative interface or limiting the IP addresses that can reach the administrative interface as a temporary mitigation.
Is Gunra a North Korean government ransomware operation?
Not precisely. The advisory notes documented infrastructure overlap between some Gunra incidents and a separate campaign attributed to a state-sponsored group using tools associated with North Korea’s Lazarus Group. South Korean security firm AhnLab assessed a “likely technical link” between the two — shared SSH key fingerprints, shared tunneling infrastructure, and shared file distribution domains — but explicitly declined to conclude the same command structure controlled both operations. The most accurate characterization is that Gunra is a financially motivated ransomware-as-a-service criminal operation with documented infrastructure and tooling overlap with North Korean state-sponsored activity, most likely representing shared tools or access brokering rather than direct state operation or direction. For background on the AhnLab findings in that campaign, see TechTimes’s Operation Double Barrel coverage.
Why does Gunra’s criminal ecosystem continue to regenerate even after individual operations are disrupted?
Gunra was built on Conti ransomware source code that a Ukrainian researcher leaked publicly in March 2022. That leak made Conti’s encryptor, infrastructure design, and operational playbook freely available to any criminal operator willing to use it, and multiple ransomware groups have since launched operations using variants of that code — of which Gunra is among the most capable. Disrupting Gunra does not remove the underlying codebase from public availability. Security researchers and law enforcement have consistently found that individual takedowns push criminal operators toward rebranding or successor groups rather than exiting ransomware entirely. Organizations should treat Gunra’s disruption, if it comes, as a pause rather than a solution to the broader threat it represents.
