- The advisory carries seals from five U.S. agencies and South Korea’s national police
- Gunra actors break in through two known vulnerabilities in internet-facing devices
- Victims have been identified in five world regions and more than 10 sectors
Five U.S. agencies and a South Korean partner have published a joint advisory on Gunra, a ransomware operation that supplies its software to affiliates who carry out the attacks. The Cybersecurity and Infrastructure Security Agency, the FBI, the Department of War Cyber Crime Center, the National Security Agency, the U.S. Secret Service and the Korean National Police Agency released the document Monday under CISA’s #StopRansomware series.
Cybersecurity in the age of agentic AI is a panel subject at the Potomac Officers Club’s 2026 Intel Summit on Sept. 24 at the Falls Church Marriott Fairview Park in Virginia. Tim Kosiba, deputy director of the National Security Agency, is among the keynote speakers. Register now.
Gunra surfaced as a ransomware variant in 2025 and moved to a ransomware-as-a-service model this year, NSA said Monday. Affiliates run a double-extortion scheme, locking up data and threatening to post stolen files to a leak site and sell them if the target refuses to pay.
How Do Gunra Actors Break In?
Two vulnerabilities give them their opening, CVE-2024-55591 and CVE-2025-24472, both in internet-facing devices.
Once inside, the actors work to stay hidden. NSA said they delete system and network access logs and wipe command history to frustrate detection and later analysis.
Data theft precedes encryption. The FBI observed operators taking business-critical documents, databases, personally identifiable information and internal email. Negotiations run through a Tor portal, where victims get five to seven days before the actors threaten to publish what they took.
Which Organizations Has Gunra Hit?
Victims have turned up in the Americas, Europe, the Middle East, Africa and the Asia-Pacific region, particularly those in the healthcare and public health, financial services and insurance, critical manufacturing and construction, transportation and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services sectors.
What Do the Agencies Recommend?
Four measures head the list of mitigation recommendations from the agencies:
- Keep operating systems, software and firmware current.
- Give priority to patching known exploited vulnerabilities on anything facing the internet.
- Hold backups that cannot be altered, kept in a separate and segmented location, and tested offline.
- Segment networks so that a single compromised device cannot open a path to other systems.
The advisory also provides detection guidance, indicators of compromise and steps to take once a compromise is suspected.
“With our partners, CISA encourages organizations to urgently mitigate vulnerabilities identified in this advisory, implement recommended actions, and adopt security measures aligned to CPGs,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.
