Gunra ransomware gang is targeting critical infrastructure worldwide, CISA warns

US security and law enforcement agencies have sounded the alarm about an emerging ransomware operation targeting government, businesses and critical infrastructure worldwide.

Gunra ransomware first appeared in April 2025 before expanding into a ransomware-as-a-service (Raas) operation in early 2026, according to a joint advisory published by the Cybersecurity and Infrastructure Security Agency (CISA).

The ransomware is derived from leaked source code belonging to Conti, a notorious ransomware operation whose malware has subsequently provided a foundation for other cybercrime groups.

The group uses a double-extortion model in which attackers steal information from compromised organizations as well as encrypting their systems. Victims that refuse to pay are threatened with publication of their stolen information on Gunra's dedicated data leak site.

Gunra now operates a formal RaaS affiliate program on dark web forums, giving partners access to a management panel, customizable ransomware tools, cross-platform payloads and supporting documentation.

Attackers communicate with victims and negotiate ransom payments through a customized portal hosted on the Tor anonymity network.

Organizations listed on Gunra's leak site span the Americas, Europe, the Middle East, Africa and the Asia-Pacific region. Victims have come from sectors including health care, financial services, insurance, manufacturing, construction, transportation, logistics, government, utilities, academia, media, retail and professional services.

The agencies urged organizations to prioritize patching known exploited vulnerabilities in internet-facing infrastructure, particularly VPN gateways and systems exposing Remote Desktop Protocol services.

Defenders should also maintain tested, immutable offline backups in physically separate and segmented locations, the agencies said. Network segmentation can limit attackers' ability to move from an initially compromised machine into other parts of an organization's infrastructure.

Critical infrastructure under attack

The warning comes amid growing concern about cyberattacks on critical infrastructure, with the UK’s National Cyber Security Centre recently warning that Russian-aligned hackers are targeting critical infrastructure and local government in attacks designed to disrupt essential services.

John Strand, owner of Black Hills Information Security, said the goal of targeting critical infrastructure is "two-fold".

He added: "With nation-state attacks, the objective can be straightforward. You want to create pain for your adversary. But with ransomware groups, I think there are two things we need to understand.

“First, critical infrastructure has become a dinner bell. Ransomware groups have seen how exposed and neglected some of this infrastructure is in countries like the United States, and now they’re swarming toward it because they recognize the opportunity.

READ MORE: Russian "Laundry Bear" threat actor rinses Western victims with zero-click exploit

“The second factor is pain. There’s been a major push in the security industry for organizations to refuse ransomware payments. But that position becomes much more complicated when an attack against critical infrastructure potentially impacts hundreds of thousands or even millions of people. 

"It’s one thing to say you won’t pay the bad guys when the impact is contained to your organization. It’s another thing entirely when water, power, healthcare, or essential municipal services are disrupted. At that point, refusing to pay may sound principled, but elected officials also have to answer to the people whose lives are being disrupted. That creates enormous pressure to restore those services as quickly as possible."

Gunra exposed

Once inside a victim’s network, Gunra actors use a range of techniques to deepen their access, evade detection, and prepare systems for data theft and encryption.

Gunra threat actors are known to:

• Steal credentials: Gunra actors use tools including Impacket's secretsdump.py to extract password hashes from compromised domain controllers, helping them move laterally through networks.
• Hijack sessions: Attackers intercepted VPN authentication traffic and stole session cookies, allowing them to impersonate legitimate users.
• Target privileged accounts: In one case, they stole an encryption key and used it to decrypt credentials for enterprise servers.
• Cover their tracks: Gunra actors delete access logs and command histories and often operate between 10 p.m. and 6 a.m. to reduce the chance of detection.
• Steal huge volumes of data: The FBI observed theft from OneDrive and SharePoint, including business documents, databases, emails and personally identifiable information. Some attacks involved tens of terabytes of data.
• Encrypt at speed: Gunra uses multithreading and ChaCha20 + RSA-4096 encryption to encrypt multiple files simultaneously, typically adding the .ENCRT extension.
• Destroy recovery options: Attackers delete Windows shadow copies and have destroyed backups at both primary and disaster-recovery data centers.
• Make enormous ransom demands: Negotiations have started at tens of millions of dollars, with victims typically given five to seven days to respond.

Exploiting MFA

 Jacob Krell, Senior Director of Secure AI Solutions & Cybersecurity with Suzu Labs, explained that Gunra made multi-factor authentication (MFA) "lie for them".

He said: "In the South Korean case, the group modified virtual desktop infrastructure (VDI) authentication files to accept a hardcoded attacker-chosen one-time password, and every subsequent login looked legitimate to monitoring tools. Most organizations treat MFA as the last line of defense. Gunra treated it as the first thing to subvert.

 "The sector targeting is economic. Healthcare, financial services, and government can't tolerate downtime or survive a data leak. Encrypting their systems while threatening to publish stolen records hits both pressure points at once.

“CVE-2024-55591 and CVE-2025-24472, the two Fortinet authentication bypasses that got them initial access, are eighteen months old and have been exploited by multiple ransomware groups. Patching fixes the entry point. It does nothing about an authentication backdoor already embedded in the MFA flow. I've seen organizations close the vulnerability and declare themselves clean while the attacker's persistence mechanism sat untouched in the auth stack. 

READ MORE: "Savants in the network": Why AI agents don’t need to go rogue to become dangerous

“The advisory also flags a recoverable flaw in Gunra's Linux encryptor. The variant seeds its ChaCha20 keys with time() instead of a secure random number generator, so defenders who preserve file timestamps can reconstruct keys without paying. Any organization hit by the Linux variant should get forensics involved before wiring cryptocurrency.

“Gunra created a "forticloud-sync" account with super user privileges and a hardcoded password on compromised Fortinet firewalls. That account survives a firmware update, and so do modified VDI authentication files. An organization that patches and stops there is giving Gunra a head start on round two.”

Follow Machine on LinkedIn