Six agencies publish AA26-222A
The FBI, CISA, the Department of Defense Cyber Crime Center (DC3), the NSA, the U.S. Secret Service and the Republic of Korea’s National Police Agency have released a joint #StopRansomware advisory, AA26-222A, on Gunra ransomware. It includes indicators of compromise, detection guidance and mitigations.
According to the advisory, Gunra first appeared in April 2025. It is double-extortion ransomware built from leaked Conti source code. In early 2026 the operators turned it into a ransomware-as-a-service affiliate program and started advertising it on dark web forums.
Fortinet bugs in, backups deleted
- Initial access: exploiting CVE-2024-55591 and CVE-2025-24472 in internet-facing devices.
- Extortion: data is stolen and encrypted. Victims negotiate through a Tor-based portal and are told to pay within five to seven days or see data published on a leak site.
- Recovery sabotage: the actors have disabled backup features. In one case they deleted backup and archived data at both a primary data center and a disaster recovery site.
- Growth: the group has adopted branding aliases, including “Golden Community”, and recruits penetration testers as initial access brokers in exchange for a share of ransom profits.
Healthcare, finance and government on the list
The agencies say affiliates target government and critical infrastructure worldwide, including healthcare and public health, financial services, government services and facilities, and professional and nonprofit services.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Patch the two CVEs and wall off backups
- Patch known exploited vulnerabilities in internet-facing systems, starting with the two CVEs named in the advisory.
- Keep backups immutable, stored in a physically separate, segmented location and tested offline, including disaster recovery copies.
- Segment networks to limit lateral movement from a first compromised device.
- Load the advisory’s indicators of compromise into detection tools and hunt for matches.
A second DR site was not enough
Gunra wiped backups at a primary site and at the recovery site. A separate DR location did not stop it. Backups have to sit out of reach of the admin credentials attackers can steal.
Source Context
Primary sources and original reporting:
- CISA: #StopRansomware: Gunra Ransomware (AA26-222A)
- CISA: CISA, FBI, and Partners Release Joint Cybersecurity Advisory on Gunra Ransomware
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
