Gunra Ransomware Matures Into RaaS Platform
CISA and FBI warn that Gunra, a Conti-derived ransomware group, has launched a RaaS affiliate program and is exploiting Fortinet flaws for double-extortion attacks worldwide.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2024-55591 and CVE-2025-24472 as exploited in the wild.
A joint advisory from FBI, CISA, DC3, NSA, USSS, and South Korea's KNPA details the evolution of Gunra ransomware, which first appeared in April 2025 as a double-extortion variant built on leaked Conti source code. By early 2026 the group had matured into a structured ransomware-as-a-service operation, rebranding some activity as "Golden Community," recruiting affiliates and initial access brokers (including penetration testers) via dark web forums, and offering a management panel and cross-platform locker builder. Victims span healthcare, financial services, manufacturing, transportation, government, utilities, education, media, retail, and nonprofit sectors across the Americas, Europe, MEA, and APAC.
Gunra actors gain initial access primarily by exploiting known Fortinet authentication bypass vulnerabilities (CVE-2024-55591, CVE-2025-24472) and SSH/VPN credential weaknesses, then use Impacket tools (psexec.py, secretsdump.py, smbclient.py) for lateral movement and credential dumping via NTDS extraction. Observed intrusions show sophisticated tradecraft including SSL-VPN session hijacking, MFA bypass via authentication file tampering, and theft of encryption keys to decrypt stored server credentials. The Windows encryptor uses ChaCha20+RSA-4096 for fast multi-threaded encryption (.ENCRT extension), deletes shadow copies and backups, and exfiltrates data via OneDrive/SharePoint abuse, Mega, and tools like RClone and FileZilla, with some incidents involving tens of terabytes of stolen data.
Notably, researchers identified a cryptographic weakness in Gunra's Linux ELF variant (.GNRA extension): encryption keys are seeded with a predictable time(NULL)-based PRNG, allowing victims to potentially reconstruct keys and recover files without paying ransom. The advisory recommends prioritized patching of internet-facing VPN/RDP infrastructure, offline immutable backups, network segmentation, and MFA enforcement to mitigate the threat.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs