US and Korean agencies warn about Gunra, a fast-growing ransomware gang built from leaked Conti code
The FBI, CISA and Korea's National Police Agency say Gunra has hit hospitals, utilities, banks and manufacturers across five continents since April 2025.
Key points
- The FBI, CISA, NSA, Secret Service, DC3 and the Republic of Korea's National Police Agency issued a joint advisory on Gunra ransomware on August 10, 2026.
- Gunra first appeared in April 2025 and launched a formal affiliate program, sometimes branded Golden Community, in January 2026.
- The gang breaks in mainly by exploiting Fortinet firewall and VPN bugs, including CVE-2024-55591 and CVE-2025-24472.
- Victims are given 5 to 7 days to negotiate over a Tor site and the encrypted chat app qTox before stolen data is auctioned.
- Gunra's code is based on the Conti ransomware source code that leaked in 2022, and now runs on both Windows and Linux.
Six government agencies have joined up to warn businesses about a ransomware crew called Gunra, which has been quietly building one of the busier extortion operations of the past year.
Ransomware is malicious software that scrambles a company's files so nobody can open them, then demands payment for the key. Gunra adds a second squeeze: it steals a copy of the files first and threatens to publish them on a dark web site if the victim refuses to pay.
The joint advisory from CISA, the FBI, the NSA, the Secret Service, the Defense Department's Cyber Crime Center and the Republic of Korea's National Police Agency lands on August 10, 2026. It is part of the long-running #StopRansomware series.
Who is Gunra and where did they come from?
Gunra is a criminal group that rents its ransomware out to other criminals, a model the industry calls ransomware-as-a-service. The FBI first spotted the malware in April 2025. By January 2026 the group had opened a proper affiliate program on dark web forums, complete with a builder tool, documentation and cross-platform payloads. It has also operated under the alias Golden Community.
In practice, this is the same playbook we saw with Conti and LockBit. The core team writes the code and runs the leak site. Affiliates do the breaking-in and take a cut of the ransom.
The code itself is not new work. Investigators say Gunra is built on the Conti ransomware source code, which spilled onto the internet in 2022 after Conti's internal chats were leaked. That leak has been the gift that keeps giving for copycats.
How are the criminals getting in?
Mostly through unpatched firewalls and VPN boxes sitting on the public internet. A VPN, or virtual private network, is the encrypted tunnel staff use to reach work systems from home. If the box running that tunnel has a known bug, attackers walk straight through it.
The FBI names two Fortinet flaws in particular:
| CVE | Product | What it does |
|---|---|---|
| CVE-2024-55591 | FortiOS, FortiProxy | Lets an attacker skip the login |
| CVE-2025-24472 | FortiOS, FortiProxy | Lets an attacker skip the login |
Korean investigators also saw Gunra affiliates using exposed credentials and weak SSH settings on VPN gateways. SSH is the remote-login tool administrators use to manage servers.
The failure mode here is depressingly familiar. Edge devices are hard to patch, easy to forget, and sit in front of everything valuable.
What happens to a victim?
Once inside, the malware walks every drive from A to Z, encrypting files as it goes. It drops a ransom note in every folder pointing the victim to a Tor site, where they are handed a Client ID and password. They are then told to negotiate on qTox, an encrypted chat app, within 5 to 7 days. Miss the window and the stolen data goes up for sale.
Victims listed on Gunra's leak site so far span healthcare, banking, manufacturing, transport, utilities, government, schools, retail and media, across the Americas, Europe, the Middle East, Africa and the Asia-Pacific. Gunra started as a Windows-only tool but added a Linux version in mid-2025, which matters because a lot of business servers run Linux.
Should ordinary people worry?
Not directly, but the knock-on effects are real. When a hospital, bank or utility gets hit, patients get appointments cancelled, customers lose access to accounts, and staff data often ends up on a leak site. If your employer or a service you use tells you your information was in a Gunra breach, treat the notification seriously: change reused passwords, turn on two-step login, and watch for phishing emails referencing the incident.
Operational takeaway for defenders: patch your edge boxes this week, keep offline backups you have actually tested, and segment your network so one compromised laptop is not a free pass to the file servers.
