Cybersecurity and intelligence companies from South Korea and the U.S. warned of Gunra ransomware assaults concentrating on essential infrastructure sectors and organizations internationally.
Targets of those assaults embody healthcare and public well being, monetary companies, authorities companies and services, {and professional} and nonprofit companies.
“Gunra is one other variant within the ongoing pattern of ransomware assaults inflicting disruption and hurt to U.S. and worldwide organizations,” CISA Performing Government Assistant Director for Cybersecurity, Chris Butera, mentioned.
Assaults deploying the ransomware have leveraged safety flaws in internet-facing Schneider Electrical PowerLogic P5 (CVE-2024-5559) and Fortinet FortiOS and FortiProxy (CVE-2025-24472) home equipment to acquire preliminary entry, after which deploy the Gunra ransomware as a part of a double extortion mannequin that mixes knowledge exfiltration and knowledge encryption for optimum affect.
Victims who refuse to pay up inside 5 to seven days have their knowledge revealed on a knowledge leak website. In keeping with data revealed on Ransomware.Reside, Gunra has listed a complete of 51 victims since rising within the risk panorama in April 2025, with most of them from South Korea, Brazil, Spain, Thailand, and Hong Kong.
What’s notable in regards to the risk actor is that almost all of the targets are situated in Australia, East Asia, and Europe. Solely three victims have been reported from Canada and the U.S. to date.
“The group makes use of phishing as a primary assault vector to ship malicious items to their targets and perform negotiations on a WhatsApp-themed chat Panel,” safety researcher Rakesh Krishnan said in an evaluation revealed final 12 months. “The group is able to encrypting big recordsdata (9TB) in a restricted timeframe by utilizing superior stream cipher encryption similar to Salsa20 or ChaCha20.”
The Conti-derived operation is claimed to have launched a proper RaaS associates program on darkish net boards in January 2026, offering associates with entry to a administration panel, a configurable ransomware builder, cross-platform locker payloads, and structured affiliate documentation.
The group provides both Windows and Linux variants of its locker, though an analysis launched by Breakglass Intelligence in March 2026 recognized a “catastrophic cryptographic weak point” within the Linux builds that made it potential to get better the encryption key and regain entry to the recordsdata.
Per the U.S. Federal Bureau of Investigation (FBI), Gunra has been noticed adopting new branding aliases, similar to Golden Group, to develop its operations, whereas concurrently taking steps to monetize its platform by recruiting penetration testers and moral hackers to function preliminary entry brokers, who’re provided a share of the ransom income in alternate for enterprise community entry.
Assault chains are recognized to leverage Impacket libraries “psexec.py” and “smbclient.py” for lateral motion utilizing the Server Message Block (SMB) protocol. One other Impacket utility, “secretsdump.py,” is used to conduct credential dumping towards compromised area controllers and extract password hashes of consumer accounts from the NT Listing Providers (NTDS) file.
To cowl up traces of malicious exercise, the group is thought to delete system/community entry logs, clear command historical past, and primarily conduct malicious actions and inside infrastructure reconnaissance between 10 p.m. and 6 a.m. Information exfiltration from Microsoft OneDrive and SharePoint is completed via an executable named “primary.exe.”
In choose instances, the risk actors have been noticed creating compressed archives containing terabytes of knowledge and exfiltrating them to the MEGA file-sharing service. Apart from gathering business-critical paperwork, the group is claimed to have linked to the digital desktop infrastructure (VDI) environments of IT personnel and harvested delicate paperwork containing system and community configuration info.
“The Gunra actors then leveraged enterprise server credentials stolen from a system entry management server to deploy ransomware to encrypt key property, together with database servers and network-attached storage (NAS) methods,” the U.S. Cybersecurity and Infrastructure Safety Company (CISA) mentioned.
In a single case noticed by South Korea’s Nationwide Police Company (KNPA), the attackers have been noticed manipulating the community site visitors management performance of an SSL-VPN equipment to intercept credentials and session info transmitted by customers authenticating to a company VDI authentication portal. These stolen session cookies have been then used to conduct session hijacking and impersonate reputable customers to realize entry to the interior community.
To bypass multi-factor authentication (MFA), Gunra is claimed to have tampered with the authentication processing recordsdata on the company VDI authentication portal server such that it enabled profitable authentication when a selected, Gunra-designated one-time password (OTP) worth was entered.
A few of the different detected behaviors are listed under –
- Getting access to an administrator account for an SSL-VPN equipment by exploiting default credentials after which downloading OpenSSH from an attacker-controlled server to arrange connections between compromised methods and preserve persistence throughout the sufferer atmosphere.
- Counting on an unused account recognized within the SSL-VPN administrative net console that had entry to each the web and inside company community, and modifying its configuration to sidestep the necessary password change requirement and empty it for follow-on actions.
- Accessing a Hiware system entry management server by way of SSH from a compromised digital desktop and stealing a symmetric encryption key saved on the server in order to decrypt passwords for enterprise server accounts saved throughout the database and carry out credential dumping of credentials related to all enterprise servers.
- Deleting backup and archived knowledge saved on backup infrastructure at each the first knowledge middle and catastrophe restoration middle earlier than and after the ransomware deployment.
The disclosure assumes significance within the face of a recent advisory from South Korea a few cyber marketing campaign orchestrated by an unspecified state-sponsored risk group from 2025 by the primary half of 2026 by exploiting vulnerabilities in an unidentified monetary safety software program to distribute malware after tricking victims into visiting malicious URLs by spear-phishing and watering hole techniques.
Apparently, a few of these incidents have additionally concerned the exploitation of the identical monetary safety software program vulnerabilities to deploy Gunra ransomware and exfiltrate delicate organizational info.
A few of the watering gap assaults, per ENKI, have additionally exploited a zero-day vulnerability in AnySign4PC, inflicting malware to be put in and executed on methods with the certificates signing software program put in when accessing the online web page containing the exploit code. A few of the payloads distributed as a part of the entire marketing campaign embody Battle (aka SIGNBT 3.0) and Brandoor (aka COPPERHEDGE), each of that are known to be used by the Lazarus Group.
“These commonalities counsel that though the state-sponsored risk group and the Gunra ransomware group look like separate risk actors with completely different final aims, they might have shared sure strategies, instruments, and infrastructure or collaborated to a restricted extent in the course of the assaults,” AhnLab mentioned.
Whereas the precise origins of Gunra are unclear, this sort of collaboration between a North Korean nation-state group and a ransomware actor isn’t exceptional. Way back to October 2024, Palo Alto Networks Unit42 said it noticed the Lazarus sub-cluster Andariel partnering with the Play ransomware crew.
Andariel itself has a monitor report of deploying customized ransomware households like SHATTEREDGLASS, Maui, and H0lyGh0st previously. In latest months, the Lazarus Group and its associated intrusion set Moonstone Sleet have additionally been attributed to assaults concentrating on South Korean and Center East entities with Qilin and Medusa ransomware.
To safe towards Gunra ransomware, organizations are suggested to maintain all working methods, software program, and firmware updated, prioritize patching recognized exploited vulnerabilities in internet-facing methods, implement community segmentation, and guarantee backups are immutable and saved in a bodily separate location.
