Overview
Gunra is a double-extortion ransomware operation first observed by the FBI in April 2025. The malware was developed from the leaked Conti ransomware source code — the same codebase that spawned Black Basta, Royal, and numerous other operations following the Conti consortium’s 2022 dissolution. Gunra spent its first several months as a relatively contained operation before pivoting to a formal ransomware-as-a-service model in January 2026.
On 10 August 2026, CISA, the FBI, the NSA, the Department of Defense Cyber Crime Center, the U.S. Secret Service, and South Korea’s National Police Agency published joint advisory AA26-222A detailing Gunra’s operations, TTPs, and targeting. The advisory identifies ten affected sectors and victims across the Americas, Europe, the Middle East, Africa, and Asia-Pacific.
Timeline
| Date | Development |
|---|---|
| April 2025 | FBI first observes Gunra ransomware variant in the wild |
| Mid-2025 | Linux variant added to targeting envelope |
| January 2026 | Formal RaaS affiliate program launched on dark web forums |
| Q1 2026 | Gunra observed operating under “Golden Community” alias |
| August 10, 2026 | Joint CISA/FBI/NSA advisory AA26-222A published |
Ransomware-as-a-Service Structure
Gunra’s transition to a RaaS model followed the standard playbook for post-Conti operations. The core group — responsible for encryptor development, infrastructure, and negotiation platform — provides affiliates with:
- A management panel for victim tracking and negotiation management
- A configurable ransomware builder for Windows (x86 and ARM) and Linux targets
- Affiliate documentation including initial access and escalation playbooks
- A Tor-based victim negotiation portal with countdown timers and a messaging interface
- Access to the Gunra dedicated leak site (DLS) for extortion pressure
The affiliate program recruits through dark web forums and is notable for explicitly targeting penetration testers and ethical hackers as initial access brokers (IABs). Affiliates receive a percentage of ransom payments, with the core group retaining a cut of each successful attack.
The group has operated under the alias Golden Community in some recruitment and communications contexts, which has created attribution complexity in early incidents before the connection was established.
Initial Access Methods
Gunra actors and affiliates gain initial access primarily by exploiting two known vulnerabilities in internet-facing VPN and network perimeter devices:
- CVE-2024-5559 — Authentication bypass in a VPN appliance model deployed across enterprise and mid-market organisations globally. Exploitation allows attackers to authenticate as any configured user without valid credentials.
- CVE-2025-24472 — Remote code execution in an internet-facing network access device. Exploitation provides initial foothold for further activity.
Both vulnerabilities were patched by their respective vendors before Gunra began actively exploiting them, making unpatched perimeter device inventories the primary risk factor for initial exposure.
Post-Access Kill Chain
Gunra’s post-access behaviour reflects Conti operational playbooks:
- Credential harvesting — LSASS memory dump via comsvcs.dll MiniDump or Mimikatz variants; Kerberoasting for domain service account hashes
- Lateral movement — SMB lateral movement via PsExec or Impacket wmiexec; RDP movement using harvested domain credentials
- Data staging and exfiltration — Bulk data collection to staging share; exfiltration to attacker-controlled cloud storage prior to encryption (enabling the extortion pressure component)
- Defense evasion — Disabling or tampering with Windows Defender via registry modifications; terminating backup and security software processes
- Encryption — Mass file encryption; volume shadow copy deletion via vssadmin to prevent recovery
- Ransom note deployment — README files placed in encrypted directories directing victims to the Tor negotiation portal
The Linux variant targets ESXi hypervisors to maximise impact through single-shot encryption of VM guest disk files.
Targeting Profile
The advisory names ten confirmed affected sectors. Healthcare and financial services receive prominent mention, reflecting the higher-than-average likelihood of payment from organisations with strong operational dependencies on encrypted data and regulatory obligations around data availability.
| Sector | Notes |
|---|---|
| Healthcare and Public Health | High payment pressure; patient data exfiltration for extortion |
| Financial Services and Insurance | Time-critical systems; regulatory reporting pressure |
| Critical Manufacturing | OT-adjacent exposure; supply chain disruption leverage |
| Transportation and Logistics | Operational dependency on availability; route/scheduling data |
| Government Services and Facilities | Combination of sensitive data and reputational pressure |
| Utilities | Public sector + critical service pressure |
| Academia | Weak perimeter controls; research IP exfiltration |
| Media and Communications | High-profile; publication timing leverage |
| Retail | PCI data; seasonal timing leverage (Q4) |
| Professional and Nonprofit Services | Client data leverage; reputational risk |
Confirmed victims span the Americas, Europe, Middle East, Africa, and Asia-Pacific, indicating affiliate recruitment from multiple jurisdictions.
Negotiation and Payment
Gunra runs a Tor-based negotiation portal described in the advisory as more polished than typical operations at this scale. The portal includes a victim communications interface, countdown timers tracking the payment deadline, and a clear threat that non-payment triggers data publication.
The group maintains a dedicated leak site for publishing stolen data from non-paying victims. Prior to the advisory publication, the leak site contained data from victims across multiple named sectors.
No ransom payment ranges have been officially confirmed in the advisory. Incident responders have observed demands consistent with other mid-tier RaaS operations: six figures for mid-market organisations, seven figures for enterprise targets with larger data sets and more extensive operational impact.
Detection Indicators
Key behavioural indicators associated with Gunra affiliate activity (from AA26-222A):
- Authentication events from VPN appliance IPs to internal hosts in rapid succession following a period of inactivity
- LSASS memory access with GrantedAccess masks 0x1010 or 0x1410 from non-security processes
vssadmin.exe delete shadows /all /quietorwmic shadowcopy deletecommand execution- Ransom note files with names containing “GUNRA”, “DECRYPT”, or “HOW_TO”
- Outbound connections to Tor entry nodes from workstations or servers
Defensive Recommendations
Immediate (for unpatched organisations):
- Apply patches for CVE-2024-5559 and CVE-2025-24472 on all internet-facing perimeter devices
- Audit VPN authentication logs for anomalous access patterns over the past 90 days
- Verify offline backups exist and cannot be reached from any potentially compromised host
Structural:
- Require MFA on all VPN and remote access entry points
- Segment networks to limit lateral movement radius following an initial compromise
- Enable Controlled Folder Access or equivalent to restrict mass file modification