A joint advisory by U.S This article explores threat gunra ransomware. . and South Korean authorities has warned that the Gunra ransomware operation is exploiting vulnerabilities in Fortinet VPN appliances, weak remote-access controls, and exposed infrastructure to infiltrate enterprise networks.
The ransomware-as-a-service (RaaS) group has targeted various sectors including government, healthcare, finance, manufacturing, transportation, utilities, education, media, and retail. By early 2026, the operators had established a structured affiliate program, offering a ransomware builder, management panel, cross-platform payloads, and documentation on dark web forums. The group employs a dual-extortion tactic. It steals sensitive data beforehand before encrypting files, then threatens to leak or sell the information through a dedicated leak site unless the victim pays.
After gaining entry into the compromised environment, Gunra operators used Impacket tools like psexec.py, smbclient.py, and secretsdump.py to move through networks over SMB, extract password hashes from Active Directory domain controllers, and perform pass-the-hash or pass-the-ticket attacks. Category Details Threat name Gunra ransomware Model Ransomware-as-a-Service (RaaS) with affiliate operations First observed in April 2025 The group also obtained credentials and session data by manipulating SSL VPN device traffic-control functions.
