Six government agencies have issued a joint warning about Gunra, a ransomware-as-a-service operation that is breaking into hospitals, utilities and government bodies by exploiting known bugs in internet-facing VPN and firewall appliances.
The advisory was published on August 10 by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Defense Cyber Crime Center (DC3), the National Security Agency (NSA), the U.S. Secret Service and the Republic of Korea's National Police Agency (KNPA). It is the latest entry in the #StopRansomware series, and you can read the original advisory in full.
Who is behind Gunra
The FBI first observed Gunra in April 2025. The agencies assess that the encryptor appears to be based on, or significantly influenced by, the Conti ransomware source code that leaked in 2022. In January 2026 the crew turned professional, launching an affiliate program on dark web forums that hands recruits a management panel, a configurable ransomware builder, cross-platform locker payloads and written affiliate documentation. The FBI has also seen the group adopt a new brand, Golden Community, and openly recruit penetration testers to work as initial access brokers in exchange for a share of the ransom.
Victims listed on the group's Tor leak site span the Americas, Europe, the Middle East, Africa and the Asia-Pacific. Healthcare and public health, financial services and insurance, critical manufacturing and construction, transport and logistics, government, utilities, academia, media, retail and nonprofits are all represented. IntelFusions reported in July on Gunra payloads pushed through hacked Korean websites, and our Gunra actor profile tracks the group's claimed victims.
How the attacks work
Initial access comes primarily from unpatched edge devices. The FBI names two authentication bypass flaws in Fortinet's FortiOS and FortiProxy, CVE-2024-55591 and CVE-2025-24472, which let an attacker reach the device without valid credentials. KNPA separately observed Gunra actors abusing credential exposure and weak SSH access controls on internet-facing VPN gateways. In one case the actors logged into an SSL-VPN administration account using default credentials, because account lockout was not in place, then reconfigured an unused account to skip the mandatory password change and used it as their own.
From there the tradecraft is methodical. The actors used the Impacket toolkit's psexec.py and smbclient.py to move across networks over SMB, downloaded OpenSSH from an attacker-controlled server to tunnel traffic back out, and ran secretsdump.py against domain controllers to lift password hashes from the NTDS database, which they replayed in pass-the-hash and pass-the-ticket attacks. At one victim they manipulated traffic handling on an SSL-VPN appliance to harvest credentials and session data from users signing in to a corporate virtual desktop portal, then hijacked those live sessions to walk into the internal network. They also edited the portal's authentication files so that one attacker-chosen one-time passcode would always be accepted, giving them a standing way around multi-factor authentication.
Once inside, the Windows encryptor enumerates every drive letter from A to Z using the Windows FindFirstFileW and FindNextFileW functions before encrypting what it finds. Victims get a ransom note in every affected directory, a Client ID and password for a Tor negotiation portal, and instructions to contact the operators over the encrypted messenger qTox, with five to seven days to settle before the data is offered on the leak site.
What you should do
The authoring agencies put three actions first: patch known exploited vulnerabilities on anything facing the internet, especially VPN gateways and RDP-exposed infrastructure; keep offline, immutable backups in a physically separate, segmented location so recovery never depends on paying; and segment networks so one compromised machine does not open the whole estate. The advisory ships machine-readable indicators as STIX XML and JSON alongside a full MITRE ATT&CK mapping.
Indicators
A selection of the published indicators, defanged: sample hashes 2dc70a12d158d437e45a55b1d52f3d61c6082a1e1667573302ba3b62813e2751 and 834efe9b392c6c000877ea5613a079445affc16fe8af5997d68c55cafc95e5d1, and the addresses 86[.]54[.]28[.]216, 103[.]125[.]234[.]14 and 91[.]201[.]66[.]146. The advisory also lists five neighbouring addresses from 23[.]239[.]119[.]2 to 23[.]239[.]119[.]6. The complete set is in the STIX bundle linked above.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.