US and South Korean Agencies Warn of Gunra Ransomware Attacks
US and South Korean security agencies have issued a joint warning about Gunra ransomware, an operation that first appeared in 2025 and expanded into a ransomware-as-a-service model in 2026. The August 10 joint CISA advisory, authored with the FBI, NSA, Department of Defense Cyber Crime Center, US Secret Service, and South Korea’s National Police Agency, says Gunra affiliates have targeted government, critical infrastructure, healthcare, financial services, transportation, utilities, and other organizations across multiple regions.
The advisory describes a double-extortion model in which attackers steal data before encrypting systems and threaten to publish the stolen material if victims do not pay. It also recommends that organizations maintain and test offline or immutable backups in physically separate or segmented locations. That matches the 3-2-1-1-0 backup rule, which is designed to reduce the chance that a ransomware incident can destroy production and recovery copies at the same time.
Gunra is exploiting known weaknesses at the network edge
According to the advisory and subsequent reporting, Gunra actors have used known vulnerabilities in internet-facing appliances for initial access. The government guidance specifically emphasizes patching exposed VPN gateways and remote access infrastructure, while security reporting has highlighted Fortinet flaws CVE-2024-55591 and CVE-2025-24472 as vulnerabilities used by the operation.
Ransomware entry points are often ordinary infrastructure left exposed or unpatched, with no exotic zero-day involved. Edge devices can be especially valuable to attackers because they sit at trusted network boundaries and may provide access before endpoint controls can intervene. Once inside, ransomware affiliates can move laterally, steal credentials, identify valuable systems, exfiltrate data, and then launch encryption.
Backup strategy has to assume an active attacker
Gunra’s double-extortion model means recovery is only one part of the problem, because restoring systems does not reverse data theft. Even so, strong recovery options can remove some of the attacker’s leverage by reducing dependence on a decryptor and shortening operational disruption.
Backups have to survive the same incident. An attacker with broad administrative access may attempt to delete snapshots, compromise backup credentials, erase repositories, or encrypt connected storage. A backup program therefore needs separation of duties, restricted access, immutable or offline copies, and routine verification. Teams should also perform backup testing across files, applications, and full systems so recovery procedures are known before an emergency.
The warning is about operations as much as malware
The advisory describes a repeatable criminal operating model instead of one isolated malware sample, and that is what makes Gunra worth attention. Ransomware as a service allows affiliates to use shared tooling and infrastructure while choosing their own targets. That model can scale quickly when known vulnerabilities remain available across large numbers of internet-facing systems.
Defenders should respond to the complete attack path. That means patching exposed systems, restricting remote administration, segmenting networks and protecting privileged accounts. It also means monitoring for lateral movement and unusual data transfer and keeping recovery infrastructure separated from production trust. After that, test whether critical workloads can actually be rebuilt within acceptable recovery objectives.
No single ransomware product or security control covers all of that. What works is an operating model that reduces initial access, limits movement after compromise, detects abnormal activity, and preserves a clean path to recovery, with organizations preparing for all four stages at the same time.
Originally published on the Mr.PlanB blog.