TL;DR · 30-second read

The Short Version

Government agencies in the United States and South Korea have jointly warned about a criminal hacking group called Gunra. It breaks into organizations, copies their private files, locks everything up, then demands payment, threatening to publish or sell the stolen files if victims refuse.

Its main way in is the security equipment that lets employees log in to work networks from home. Once inside, it erases its tracks and works overnight, between 10 at night and 6 in the morning.

Hospitals, banks, utilities and universities are among its targets. One bright spot: a flaw in one version lets some victims unlock files without paying.

Industrial Cyber reported that the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Defense Cyber Crime Center (DC3), the National Security Agency (NSA), the US Secret Service and South Korea’s National Police Agency (KNPA) released a joint advisory Monday on Gunra, a ransomware operation derived from leaked Conti source code. Gunra steals data, encrypts systems and threatens to publish or sell the stolen data on its leak site, with victims listed across the Americas, Europe, the Middle East, Africa and the Asia-Pacific region.

The advisory says Gunra gets in mainly by exploiting known flaws in internet-facing firewall and VPN appliances, including two authentication-bypass vulnerabilities in specific FortiOS and FortiProxy versions (CVE-2024-55591 and CVE-2025-24472), deletes logs to hide, and works primarily between 10 p.m. and 6 a.m.

Executive Summary

Six US and South Korean agencies have published a detailed account of how Gunra ransomware operates, from initial access to extortion. Gunra emerged in April 2025, added a Linux variant by mid-2025, and by early 2026 had become a ransomware-as-a-service operation that recruits affiliates on dark web forums. Its leak site lists victims in more than ten sectors, including healthcare, finance, utilities, transportation and government.

For infrastructure operators, the advisory’s significance is where the attack begins and how it hides. Entry runs through the edge: firewall and VPN appliances with known vulnerabilities, default credentials or weak access controls. Once inside, the actors delete system and network access logs, clear command history, work overnight and run an encryptor that produces no observable network indicators. That combination leaves appliance logs held somewhere the attacker cannot reach, and watched after hours, among the most useful signals a defender has.

The advisory also contains a rare point in defenders’ favor: as of March 2026, Gunra’s Linux variants use weak, time-seeded randomness that lets encryption keys be reconstructed and files recovered without payment, though that does nothing about data already stolen.

The Front Door Is the Security Appliance Itself

The most consequential detail for infrastructure operators is how Gunra gets in. The FBI observed the group obtaining initial access primarily by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN appliances, and named two authentication-bypass flaws in specific FortiOS and FortiProxy versions: CVE-2024-55591 and CVE-2025-24472. An authentication bypass lets an attacker reach functions that should require a login without valid credentials. South Korea’s National Police Agency separately observed Gunra exploiting credential exposure and Secure Shell (SSH) access-control weaknesses on internet-facing VPN gateways.

The intrusion the agencies describe shows how modest the first step can be: default credentials on an SSL-VPN appliance, the encrypted gateway remote staff use to reach internal systems, with no account lockout to stop repeated guessing. After compromising an administrator workstation, the actors reached the appliance’s administrative console, found an unused account with access to both external and internal networks, and modified it to skip a mandatory password change, creating a persistent backdoor that looks like an ordinary account.

For data center, colocation and network operators, firewalls and VPN concentrators sit at the boundary of nearly everything they run, including remote administration paths into their own environments. Because both named CVEs are known vulnerabilities, the defense here is patch cadence and asset inventory rather than anything exotic. The practical test is whether an operator can list every internet-facing appliance it owns, its firmware version and every account configured on it, including dormant ones.

Why Edge Appliance Logs Belong Off the Box

Gunra is built to leave few traces where defenders usually look. According to the advisory, the actors delete system and network access logs and clear command history while active, conduct reconnaissance and encryption primarily between 10 p.m. and 6 a.m., and run the encryptor as a self-contained binary that produces no observable network indicators. Data is exfiltrated before encryption, so by the time files lock, the extortion leverage has already left the network.

Taken together, those facts narrow the useful evidence to a short list, and the advisory’s own incident-response guidance points at it: review network appliance logs for anomalous privileged activity and audit file creation to detect exfiltration. Logs that exist only on the compromised appliance or host are exactly what the actors delete. Logs forwarded in near real time to a separate, access-controlled collector survive that deletion, and they only help if someone, or an automated rule, is watching during the overnight window the group favors.

This falls hardest on organizations that run round-the-clock infrastructure with thin overnight staffing, and on managed service providers that administer appliances for many customers. An after-hours login to a VPN administrative console, a dormant account suddenly modified, or a change to appliance traffic controls are low-volume events that are straightforward to alert on, provided the record sits where the attacker cannot erase it. None of this is new practice, but Gunra’s combination of edge entry, log wiping and night-time activity turns off-device logging from a best-practice line item into the difference between catching the intrusion before encryption and discovering it from a ransom note.

MFA and Credentials Fail at the Seams

The advisory is a reminder that multi-factor authentication (MFA) protects a login step, not the systems behind it. Against one victim, Gunra modified files on the virtual desktop infrastructure (VDI) authentication portal, the gateway to remotely hosted desktops, so it would accept a designated one-time password. The actors also manipulated SSL-VPN traffic controls to harvest credentials and session cookies, hijacked sessions to impersonate legitimate users, and entered the internal VDI environment with stolen session tokens.

Inside, the playbook targets the identity core. Using Impacket libraries over SMB, the Windows file-sharing protocol, the actors moved laterally to the VDI authentication server, the Active Directory server that governs who can access what, and IT staff desktops. They ran secretsdump.py against the NTDS database where domain controllers store password hashes, enabling pass-the-hash and pass-the-ticket attacks that reuse stolen credentials without cracking them. At one victim they reached a Hiware system access control server over SSH and stole the symmetric key needed to decrypt enterprise server credentials stored in its database.

The operational lesson is that authentication portals, privileged-access systems and key stores are high-value targets in their own right and warrant the same integrity monitoring and segmentation as production systems. The agencies’ recommendations map onto each step: least-privilege administrative rights, audits for unrecognized accounts, MFA on all services with emphasis on VPNs and webmail, network segmentation to restrict lateral movement, and disabling command-line and scripting activity where possible.

A Flaw in the Linux Encryptor, With Limits

One finding cuts in defenders’ favor. As of March 2026, the advisory says, Gunra’s Linux ELF variants use a weak pseudorandom number generator seeded with predictable system time, allowing defenders to mathematically reconstruct keys from file timestamps and recover files without paying. That is relevant to infrastructure operators because Linux underpins much of the server estate, and Gunra introduced its Linux variant in mid-2025 as it moved toward cross-platform targeting.

The limits matter. The weakness is described for the Linux variants as of a specific date, and ransomware-as-a-service operations, which rent their tooling to affiliates, can ship revised builds. Key recovery also does nothing about stolen data: the threat to publish or sell it stands regardless. Offline, immutable backups kept in a physically separate, segmented location, and tested, remain the control that makes recovery independent of both the attacker’s cooperation and the attacker’s mistakes.

Background

Gunra traces its code to Conti, a prolific ransomware operation whose source code leaked in 2022 and has since been reused by several groups. Gunra appeared in April 2025 focused on Windows systems, introduced a Linux variant by mid-2025, and by early 2026 had adopted a ransomware-as-a-service model, in which core developers supply the malware and infrastructure while recruited affiliates carry out intrusions in exchange for a share of ransoms.

Joint advisories from US agencies and foreign partners are a standard way of publishing attacker techniques, indicators and mitigations for a specific ransomware family. They typically align recommendations with CISA and NIST’s cross-sector cybersecurity performance goals, a baseline of practices such as patching internet-facing systems, maintaining offline backups, enforcing multi-factor authentication and segmenting networks.

Sources

Source: Gunra ransomware expands globally as US, South Korean agencies warn of data theft, encryption and extortion tactics — Industrial Cyber’s report on the joint FBI, CISA, DC3, NSA, Secret Service and Korean National Police Agency advisory on Gunra ransomware.