What Gunra Looks Like As An Operation
CISA, the FBI, NSA, USSS, DC3, and South Korea's KNPA describe Gunra as a ransomware-as-a-service operation that grew out of a 2025 ransomware variant and expanded into a structured affiliate program in 2026. The group uses double extortion, encrypting systems while threatening to leak stolen data through a dedicated leak site and a Tor-based negotiation portal.
The advisory says Gunra appears derived from leaked Conti source code, now supports cross-platform operations, and is actively recruiting penetration testers and ethical hackers as initial access brokers in exchange for a share of ransom profits. That is a useful sign of maturity: this is not a single crew improvising everything end to end.
How The Group Gets In
Initial access is centered on exploitable internet-facing infrastructure. The advisory specifically calls out exploitation of firewall and VPN appliances, including CVE-2024-55591 and CVE-2025-24472 in FortiOS and FortiProxy, plus credential-exposure and SSH access-control weaknesses in VPN gateways.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. Unsubscribe anytime.
Built from 100+ trusted cybersecurity sources.
That detail matters because it reinforces the oldest ransomware lesson in the book: exposed remote-access infrastructure still buys attackers their first foothold surprisingly often. If your edge devices are poorly inventoried or lightly monitored, the rest of the advisory becomes much more relevant very quickly.
What Gunra Does After Entry
The operational detail is where the CISA write-up earns attention. Gunra actors use Impacket tools such as psexec.py, smbclient.py, and secretsdump.py for lateral movement and credential theft. In one victim environment they exploited default credentials on an SSL-VPN appliance, downloaded OpenSSH from an attacker-controlled server, hijacked sessions, modified account settings, and pivoted into virtual desktop infrastructure, Active Directory, and desktops assigned to IT personnel.
The same advisory says the actors captured credentials and session data by abusing VPN traffic-control functions, then modified authentication-processing files on a VDI portal so a Gunra-chosen one-time password would bypass MFA. That is far more useful than a generic ransomware warning because it tells defenders exactly which trust assumptions failed.
Where Defenders Should Focus
This is a ransomware story, but it is also a remote-access and identity story. The recurring themes are weak edge systems, reusable credentials, session theft, and privileged lateral movement into Windows infrastructure.
That means your best early questions are not about ransom notes. They are about VPN hygiene, MFA integrity, administrative segmentation, offline backups, and whether your environment would make these pivots noisy or quiet.
What To Do Today
Treat the advisory as a defensive checklist against a real intrusion chain.
- Prioritize patching and exposure review for internet-facing VPN, firewall, and RDP-linked infrastructure before spending time on generic ransomware awareness work.
- Check for default or weak credentials on remote-access systems and verify account lockout, SSH restrictions, and MFA protections are actually enforced.
- Hunt for use of Impacket tooling, unusual OpenSSH deployment, session hijacking indicators, suspicious VDI or AD access, and unauthorized changes to authentication-processing files.
- Validate that backups are offline, immutable, segmented, and recently tested for restoration rather than merely documented in a policy file.
- Use the advisory to align infrastructure, identity, and incident-response owners around one chain of activity instead of treating edge hardening and ransomware readiness as separate programs.
Source Context
CyberExperts used CISA's #StopRansomware advisory as the primary source and preserved the parts that make it operationally valuable: Gunra's RaaS structure, the named initial-access CVEs, the identity and session-abuse tradecraft, and the concrete mitigation priorities.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
