U.S. and South Korean government agencies issued a joint #StopRansomware advisory on Monday, August 10, 2026, confirming that the Gunra ransomware operation is breaching critical infrastructure organizations worldwide by exploiting known vulnerabilities in Fortinet firewall products. The advisory, produced by CISA alongside the FBI, the NSA, the Department of Defense Cyber Crime Center, the U.S. Secret Service and the Republic of Korea's National Police Agency, describes a double-extortion crew built on leaked Conti source code, demanding ransoms in excess of $10 million with payment deadlines of five to seven days. Separately, research from South Korean firm AhnLab published alongside a four-agency Korean advisory found extensive tooling and infrastructure overlap between Gunra and a North Korea-linked state-sponsored threat group.
What Happened
The FBI says it first observed Gunra and its Tor-based data leak site in April 2025. The group is built using Conti ransomware source code leaked in 2022, placing it in the same lineage as a long list of Conti derivatives that have circulated since that leak.
By January 2026, according to the advisory as reported by both The Record and CyberScoop, Gunra had transitioned to a formal ransomware-as-a-service affiliate model and was recruiting openly on cybercriminal forums. The FBI observed the group adopting new branding aliases, notably operating under the name Golden Community, to support that expansion. More unusually, the advisory states Gunra has been actively recruiting penetration testers and self-described ethical hackers to serve as initial access brokers, offering a cut of ransom proceeds in exchange for enterprise network access.
Targeting scope differs slightly between the two outlet write-ups of the same advisory. The Record highlights healthcare, financial services and government as the primary sectors. CyberScoop lists a considerably broader set drawn from the alert: academia, financial services and insurance, government services and facilities, healthcare, manufacturing and construction, media, retail, transportation and utilities. Geographically the alert describes activity across Africa, the Americas, the Asia-Pacific, Europe and the Middle East.
Attribution of the CISA quote also varies in a minor way worth flagging for anyone citing it downstream: both outlets quote Chris Butera saying "Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations," but The Record gives his title as acting executive assistant director for cybersecurity at CISA while CyberScoop renders it as acting assistant director.
What Was Taken
The joint advisory does not publish an aggregate record count, and no reliable total for stolen data volume exists in the current reporting. What is documented is the pattern: Gunra steals data before encrypting it, publishes victim names and sample data on a Tor leak site, and escalates by emailing management staff directly at victim companies to solicit payment. The FBI notes that direct-to-executive pressure tactic has met with "limited success."
Victim-count figures in circulation come from different measurement points and should not be conflated. TechNadu, citing AhnLab, reports Gunra claimed 32 global victims as of March 2026, against 72 organizations backdoored by the state-sponsored actor in 2026 alone. Neither the U.S. nor the Korean advisory as reported provides a comparable running total, so treat the 32 figure as a single-source snapshot from a specific date rather than a current count.
Individual victim claims tracked by leak-site monitors illustrate the spread but remain unverified by the victims themselves:
- Yuditec S.A., a small Uruguayan IT firm with under 50 employees, is recorded by leak-site tracker Dark Eye as published on the Gunra site on June 30, 2026, with a disclosure date logged as May 4, 2026. Dark Eye's own "Window Zero" field renders this as a negative 57-day gap, which is an artifact of the tracker's timeline fields rather than a coherent breach chronology. Dark Eye lists proof-of-breach samples including a file tree, a 2024 finance spreadsheet, a passport scan and a signed contract.
- PT All Cosmos Biotek, an Indonesian agricultural biotechnology and fertilizer company, was listed on Gunra's leak platform according to Undercode News, which explicitly cautions that publicly available information does not confirm the attack method or the volume of stolen data.
- Weilhotel was added to Gunra's victim list on July 29, 2026, per monitoring by the ThreatMon threat intelligence team as reported by Undercode News, again with no confirmation of encryption or data volume.
All three of these listings originate from OTHER-tier trackers reporting attacker claims. Leak-site postings are marketing, not evidence, and none of these organizations have publicly confirmed a compromise.
The Attack Technique
The advisory names two specific initial access vulnerabilities: CVE-2024-55591 and CVE-2025-24472, both affecting Fortinet firewall products and both previously flagged by CISA. Gunra actors chain these to gain privileged access, then move to data theft and encryption before extortion. These are not novel zero-days; they are known, patched, widely publicized flaws that remain exploitable on unpatched perimeter devices.
The South Korean picture involves a different initial access path entirely. AhnLab's ASEC report, released Thursday alongside a joint advisory from the National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, documents a campaign it calls Operation Double Barrel. From 2025 through the first half of 2026, a state-sponsored threat actor and Gunra ran parallel campaigns against South Korean targets exploiting the same vulnerabilities in Korean financial security software, the kind of client-side software effectively mandatory for anyone using Korean banking or government services. Victims were funneled to malicious URLs via watering hole attacks on legitimate Korean websites across media, education, healthcare and manufacturing, and via spear-phishing.
The overlaps AhnLab documents are specific and hard to explain away:
- Identical malware filenames and execution arguments
- The same privilege escalation tools
- The same command-and-control servers and reverse tunneling addresses
- The same SSH key fingerprint, a cryptographic identifier that functions like a unique signature
- The same anti-forensic file deletion routine, renaming payloads to random four-character strings before wiping
The two campaigns diverged only at the objective. The state actor installed espionage backdoors in at least 72 organizations in 2026, including government agencies, cryptocurrency exchanges and IT service providers. Gunra used the same access to encrypt, exfiltrate and extort.
Attribution language matters here and the sources are not uniform. The Record frames the state-side activity as North Korea's Lazarus Group. AhnLab's own ASEC writeup refers to a "state-sponsored threat group" and explicitly stops short of definitively attributing both campaigns to one actor, saying the overlaps could indicate collaboration, shared infrastructure or access brokering, and classifying the cases as having "a high likelihood of technical linkage" requiring continued investigation. TechNadu likewise hedges with "North Korea-linked." The vendor's own cautious framing should be treated as the authoritative one.
Why It Matters
Three things about this advisory should change defender priorities rather than just adding another gang name to a tracking spreadsheet.
The initial access is boring and that is the point. Two publicly known Fortinet CVEs, both previously carried in CISA warnings, are getting critical infrastructure organizations ransomed in 2026. The advisory is not describing a capability gap. It is describing a patching gap on internet-facing security appliances.
The initial access broker market is professionalizing upward. Recruiting penetration testers and ethical hackers by name, with a revenue share model, changes the quality of access Gunra affiliates receive. It also means the intrusion tradecraft arriving at your perimeter may look like a legitimate red team engagement, because in skill terms it partly is.
The line between state espionage and criminal extortion is thinning operationally. Whether Operation Double Barrel represents collaboration, brokered access or shared supplier infrastructure, the practical consequence is the same: infrastructure and tooling that defenders classify as nation-state espionage indicators can precede a ransomware payload, and ransomware indicators can precede espionage. Triaging one and closing the ticket is no longer safe.
The $10 million-plus demands with five to seven day deadlines, paired with direct email pressure on named executives, indicate an operation designed around forcing a rushed decision at the board level rather than a technical negotiation.
What Organizations Should Do
- Patch CVE-2024-55591 and CVE-2025-24472 immediately on all Fortinet firewall devices, and audit for prior exploitation rather than assuming patching alone closes the incident. Both flaws grant privileged access, so a patched device may still have persistent attacker access established beforehand.
- Treat every internet-facing security appliance as a tier-zero asset. Inventory them, confirm each one is in the patch management program, and alert on configuration and account changes on the devices themselves, not just traffic passing through them.
- Hunt for the Operation Double Barrel indicators published in AhnLab's ASEC report, specifically the shared SSH key fingerprints, C2 and reverse tunneling addresses. Organizations with any exposure to Korean financial security software should prioritize this.
- Instrument for the anti-forensic pattern. File renames to random four-character strings immediately preceding deletion is a detectable behavior on endpoints and file servers, and it is common to both campaigns.
- Brief executives now, before the email arrives. Gunra emails management staff directly. Leadership should know in advance that such a message goes to incident response and legal, not to a reply, and that the five to seven day clock is a pressure tactic rather than a technical constraint.
- Verify offline, immutable backups actually restore. Double extortion means restoration solves encryption but not data exposure, so pair backup validation with a data classification review of what an attacker could publish from your highest-risk file shares.
- Monitor leak-site trackers for your own name and your suppliers'. The Yuditec and Weilhotel listings surfaced through third-party monitoring well before any victim statement, which is the normal sequence.
Sources: FBI, South Korea warn of Gunra ransomware gang targeting critical ... | U.S., South Korean government agencies caution to be on lookout ... | North Korea’s Lazarus Group sharing tools with ransomware hackers,... | Yuditec S.A. — GUNRA Ransomware Attack Dark Eye | Gunra Ransomware Targets Indonesian Agricultural Biotechnology Firm... | North Korean Hackers Share Tools With Gunra Ransomware, AhnLab Find... | Ransomware Groups Gunra and Deadlock Expand Victim Lists, Highlight... | Joint Cybersecurity Advisory Operation Double Barrel (The Relations...