Gunra Ransomware: CISA’s New Warning Explained

The FBI, CISA, NSA, the Department of Defense Cyber Crime Center (DC3), the U.S. Secret Service, and South Korea’s National Police Agency issued a joint cybersecurity advisory on August 10 warning about Gunra ransomware, a fast-growing strain built on leaked Conti source code that is now being sold as a service to criminals targeting government and critical infrastructure.

The advisory, published under the #StopRansomware program, is a signal that Gunra has moved from a niche threat to a priority for Western law enforcement and intelligence agencies — the presence of South Korea’s National Police Agency signals the group’s reach into the Asia-Pacific.

What is Gunra?

Gunra is a ransomware-as-a-service (RaaS) operation. It first appeared in April 2025 as a double-extortion ransomware variant derived from the Conti ransomware source code leaked in 2022. By early 2026, its operators had launched a structured affiliate program on dark web forums, recruiting criminals and — notably — even penetration testers and ethical hackers to act as initial access brokers.

The group operates under shifting branding, recently adopting the alias “Golden Community” to support its expansion. Its victims span healthcare, financial services, critical manufacturing, transportation, government, utilities, academia, and retail across the Americas, Europe, the Middle East, Africa, and Asia-Pacific.

How it gets in

Gunra actors typically gain initial access by exploiting known vulnerabilities in internet-facing devices — firewalls, VPN gateways, and RDP-exposed systems. The advisory specifically flags two Fortinet authentication-bypass vulnerabilities: CVE-2024-55591 and CVE-2025-24472, which allow attackers to create a malicious “forticloud-sync” admin account on vulnerable FortiOS devices.

Once inside, the group moves laterally using the Impacket tool suite (psexec.py, smbclient.py, secretsdump.py), dumps credentials from domain controllers, and uses pass-the-hash attacks. In one documented case, attackers bypassed multi-factor authentication by modifying a victim’s VDI authentication portal to accept a specific one-time password of their choosing — a persistent MFA backdoor.

The double-extortion model

Gunra uses a classic double-extortion strategy: it exfiltrates sensitive data before encrypting files, then threatens to publish the stolen data on a dedicated leak site unless the ransom is paid.

The ransomware encrypts files using ChaCha20 + RSA-4096 in a multi-threaded binary that renames encrypted files with an .ENCRT extension. Victims are given five to seven days to negotiate via a Tor-based portal or the encrypted messaging app qTox. Demands often start at tens of millions of dollars, paid in cryptocurrency.

The group has exfiltrated up to tens of terabytes from some victims, using tools like 7-Zip, RClone, FileZilla, and a custom “main.exe” that targets Microsoft OneDrive and SharePoint.

The Linux variant’s fatal flaw

One genuinely unusual detail: researchers identified a weakness in Gunra’s Linux variant (which appends a .GNRA extension). The encryption keys use a weak pseudorandom number generator seeded with the predictable srand(time(NULL)) value. That means defenders may be able to mathematically reconstruct the keys using file timestamps and recover files without paying the ransom.

It’s a rare bright spot in the ransomware ecosystem — and a reminder that even sophisticated criminal operations make implementation mistakes.

How to defend

The advisory’s core recommendations are straightforward: patch known-exploited vulnerabilities in VPN gateways and RDP-exposed systems, implement offline, immutable backups stored in a physically separate location, and segment networks to limit lateral movement. The agencies also emphasize enforcing MFA and disabling command-line and scripting activity where possible.

What makes Gunra notable is how quickly it professionalized. Within months of appearing, it had moved from a single variant to a managed platform with structured documentation, recruiter incentives, and multiple aliases — the same trajectory that turned earlier Conti derivatives into some of the most damaging ransomware operations on record.

For security teams, the advisory’s actionable value is the specific TTPs and indicators of compromise it publishes — including malicious file hashes, ransomware negotiation email addresses, and the .onion addresses of the group’s leak site.

Bottom line

Gunra is a textbook example of how leaked ransomware code becomes a commercial criminal platform. Its double-extortion model, professional affiliate program, and willingness to recruit penetration testers make it a serious and growing threat. For defenders, the playbook is unchanged but urgent: patch internet-facing systems, keep offline backups, and assume a breach will eventually be attempted.