Federal agencies warn of Gunra ransomware targeting critical infrastructure worldwide
CISA, the FBI, and South Korean authorities issued a joint advisory on the Gunra ransomware group targeting hospitals, banks, and utilities worldwide. Source: CISA Advisory AA26-222A.
U.S. and South Korean government agencies issued a joint cybersecurity advisory on August 10, 2026, warning organizations worldwide about the Gunra ransomware group. Gunra grew out of leaked Conti ransomware source code and now operates as a ransomware-as-a-service offering used by hired criminal affiliates. The advisory says individual attacks have stolen tens of terabytes of data, with ransom demands opening at amounts exceeding tens of millions of dollars. Attackers have been exploiting two known Fortinet firewall vulnerabilities, CVE-2024-55591 and CVE-2025-24472, to gain access. Researchers also identified a cryptographic weakness in Gunra's Linux encryption malware that may allow some victims to recover files without paying. Source: CISA Advisory AA26-222A / The Record.