US and South Korea Warn of Gunra Ransomware Attacks on Government Agencies

On Monday, US federal agencies joined South Korea's National Police Agency in issuing a joint alert aimed at government organizations and critical infrastructure operators around the world. At issue are attacks by the Gunra ransomware group, whose malware is built on the source code of the Conti ransomware that leaked in February 2022.

Gunra first surfaced in April 2025 as a polished double-extortion operation: the attackers not only encrypt data but also threaten to publish it. According to the authors of the alert, the group strikes across a wide range of industries — from healthcare to the financial sector and government services. The FBI notes a curious detail: Gunra's operators tried to write directly to the leadership of the affected companies, begging for a ransom — though without much success.

How They Break Into Networks

For initial access, Gunra exploits vulnerabilities in Fortinet firewalls, leveraging two critical authentication flaws (CVE-2024-55591 and CVE-2025-24472) in FortiOS and FortiProxy. The group also takes advantage of leaked credentials and weak SSH access controls on internet-facing VPN gateways. While the attacks were initially aimed exclusively at Windows environments, by mid-2025 Gunra had developed a Linux version, and its campaigns became cross-platform.

The Extortion Business

Since January 2026, the group has launched a full-fledged ransomware-as-a-service affiliate program on dark web forums. Affiliates are provided with a management panel, a customizable ransomware builder, cross-platform payloads and documentation. To support its expansion, the group has taken on a new brand — Golden Community. What's more, Gunra is actively recruiting penetration testers and “ethical hackers” to serve as initial access brokers, offering them a cut of the ransom for access to corporate networks.

The US and South Korean agencies advise network defenders to patch known exploited vulnerabilities on internet-facing systems as quickly as possible, segment their networks to limit attackers' lateral movement, and keep data backups offline.

The alert followed a separate report by the South Korean company AhnLab, prepared together with a number of the country's government agencies. It points to links between Gunra and the North Korean state-sponsored group Lazarus.

Source: Bleeping Computer