News and Analysis

US and South Korean security agencies are warning of a Ransomware as a Service (RaaS) group, Gunra, that’s been targeting government and critical infrastructure organizations around the world.The Gunra ransomware variant first appeared in 2025. According to the FBI, the group specializes in double-extortion ransomware techniques that appear to be based on – or significantly influenced by – Conti ransomware source code that was leaked in 2022. Earlier this year, the group expanded its operations through a structured RaaS affiliate program advertised on dark web forums to financially motivated cyber criminals. As part of this, it adopted new aliases, including Golden Community.Affiliates are given access to a management panel, a configurable ransomware builder, cross-platform locker payloads, and structured affiliate documentation. Gunra is using a tried-and-tested double-extortion model, both encrypting data and threatening to publish or sell exfiltrated data on a dedicated leak site if the ransom isn’t paid via a customized, Tor-based negotiation portal.How Gunra ransomware operatesInitial access is typically achieved through exploitation of known vulnerabilities in internet-facing devices, including firewall and VPN appliances, with CISA highlighting CVE-2024-55591 and CVE-2025-24472 as particular examples.Gunra’s Windows encryptor relies on native operating system APIs for both execution and targeted encryption. The threat group then regularly exploits Impacket libraries psexec.py and smbclient.py to move laterally across victim networks using the Server Message Block (SMB) protocol.The FBI said Gunra has been observed exfiltrating business-critical documents, databases, personally identifiable information, and internal email communications.”In addition to collecting business-critical documents, the [Korean National Police Agency] KNPA identified a victim case in which Gunra actors connected to the VDI environments of IT personnel and collected sensitive documents containing system and network configuration information,” CISA said in an advisory. “The actors then leveraged enterprise server credentials stolen from a system access control server to deploy ransomware to encrypt key assets, including database servers and network attached storage (NAS) systems.”Gunra attacks go globalNotably, Gunra has hit organizations in the Americas, Europe, Middle East, Africa, and Asia-Pacific across multiple industries. According to CISA, typical targets include organisations operating across the healthcare, financial services, manufacturing, transportation, government, and utilities sectors. The group also has a blossoming track record in living of the land (LOTL) techniques, having been observed sneaking under the radar, deleting system and network access logs, and clearing command histories. Authorities warned the group continues to expand operations and is actively recruiting penetration testers and ethical hackers to work as initial access brokers. Those recruited are offered a share of ransom profits in exchange for enterprise network access. The US National Security Agency (NSA) urged organizations and security professionals to remain vigilant and implement robust security measures to mitigate potential threats. “Cybersecurity architects, defensive cybersecurity analysts, vulnerability analysts, systems administrators, security systems managers, and other net defenders are advised to implement the recommended mitigations and validate their security controls: prioritizing patching known exploited vulnerabilities; implementing and testing offline, immutable backups; and segmenting networks,” the NSA said in an advisory.FOLLOW US ON SOCIAL MEDIA