US and South Korean Agencies Warn of Gunra Ransomware Attacks
US and South Korean security agencies have issued a joint warning about Gunra ransomware, an operation that first appeared in 2025 and expanded into a ransomware-as-a-service model in 2026. The August 10 joint CISA advisory, authored with the FBI, NSA, Department of Defense Cyber Crime Center, US Secret Service, and South Korea’s National Police Agency, says Gunra affiliates have targeted government, critical infrastructure, healthcare, financial services, transportation, utilities, and other organizations across multiple regions.
The advisory describes a double-extortion model in which attackers steal data before encrypting systems and threaten to publish the stolen material if victims do not pay. It also recommends that organizations maintain and test offline or immutable backups in physically separate or segmented locations. That recommendation aligns directly with the 3-2-1-1-0 backup rule, which is designed to reduce the chance that a ransomware incident can destroy production and recovery copies at the same time.
Gunra is exploiting known weaknesses at the network edge
According to the advisory and subsequent reporting, Gunra actors have used known vulnerabilities in internet-facing appliances for initial access. The government guidance specifically emphasizes patching exposed VPN gateways and remote access infrastructure, while security reporting has highlighted Fortinet flaws CVE-2024-55591 and CVE-2025-24472 as vulnerabilities used by the operation.
This is an important reminder that ransomware entry points are often ordinary infrastructure that has remained exposed or unpatched rather than an exotic zero-day. Edge devices can be especially valuable to attackers because they sit at trusted network boundaries and may provide access before endpoint controls can intervene. Once inside, ransomware affiliates can move laterally, steal credentials, identify valuable systems, exfiltrate data, and then launch encryption.
Backup strategy has to assume an active attacker
Gunra’s double-extortion model means recovery is only one part of the problem, because restoring systems does not reverse data theft. Even so, strong recovery options can remove some of the attacker’s leverage by reducing dependence on a decryptor and shortening operational disruption.
The key is that backups must survive the same incident. An attacker with broad administrative access may attempt to delete snapshots, compromise backup credentials, erase repositories, or encrypt connected storage. A backup program therefore needs separation of duties, restricted access, immutable or offline copies, and routine verification. Teams should also perform backup testing across files, applications, and full systems so recovery procedures are known before an emergency.
The warning is about operations as much as malware
Gunra is significant because the advisory describes a repeatable criminal operating model rather than one isolated malware sample. Ransomware as a service allows affiliates to use shared tooling and infrastructure while choosing their own targets. That model can scale quickly when known vulnerabilities remain available across large numbers of internet-facing systems.
For defenders, this means the response should focus on the complete attack path. Patch exposed systems. Restrict remote administration. Segment networks. Protect privileged accounts. Monitor for lateral movement and unusual data transfer. Keep recovery infrastructure separated from production trust. Then test whether critical workloads can actually be rebuilt within acceptable recovery objectives.
The strongest defense is therefore not a single ransomware product or security control. It is an operating model that reduces initial access, limits movement after compromise, detects abnormal activity, and preserves a clean path to recovery. The Gunra advisory is another reminder that organizations have to prepare for all four stages at the same time.
Originally published on the Mr.PlanB blog.