The Federal Bureau of Investigation (FBI) and South Korea’s National Policy Agency have issued a joint cybersecurity advisory regarding the Gunra ransomware gang, which is actively targeting critical infrastructure organizations globally. The group, which emerged in April 2025, is leveraging vulnerabilities in popular firewall products to gain initial access, steal data, and encrypt systems.
The advisory highlights that Gunra actors are exploiting CVE-2024-55591 and CVE-2025-24472, two vulnerabilities affecting Fortinet firewall products. These exploits allow the attackers to achieve privileged access, facilitating data exfiltration and encryption before demanding ransom payments. The FBI and South Korean authorities have observed the group targeting sectors including healthcare, financial services, and government.
Gunra ransomware is built using source code derived from the Conti ransomware, which was leaked in 2022. The FBI first identified the ransomware and its associated leak site in April 2025. By January of the following year, Gunra transitioned to a ransomware-as-a-service (RaaS) model, actively recruiting new members on cybercriminal forums. The group has also been observed operating under new aliases, including "Golden Community," as it expands its operations and commercializes its platform by recruiting initial access brokers.
Ransom demands from Gunra have been substantial, often exceeding $10 million, with victims typically given a payment window of five to seven days. The FBI noted instances where Gunra actors attempted to communicate directly with management staff at victim companies via email to solicit ransom payments, though with limited success.
Initially, Gunra focused on Windows-based systems but has since developed and deployed a Linux variant. However, researchers identified a weakness in the Linux variant as of March, which allows defenders to reconstruct encryption keys using file timestamps, potentially enabling file recovery without paying the ransom.
The advisory comes amid a broader increase in ransomware incidents, particularly those affecting critical industrial organizations. The cybersecurity firm Dragos reported 1,140 ransomware incidents impacting industrial organizations worldwide in the second quarter of 2026, marking a 12% increase from the first quarter. Gunra was attributed to at least four attacks on industrial organizations in Q2, following eight such attacks in Q1.
Concerns have also been raised about potential collaboration between Gunra and North Korea's Lazarus Group. Two weeks prior to the joint advisory, researchers indicated that some tools and infrastructure used by Lazarus Group appeared to be shared with Gunra, particularly in attacks targeting South Korean organizations. CISA, the FBI, and other agencies are actively sharing this advisory and related intelligence with government organizations and industry groups to counter the group's ongoing attacks.
