A joint #StopRansomware advisory issued on 10 August 2026 warns that the Gunra ransomware-as-a-service operation has been running double-extortion attacks against healthcare, government and critical infrastructure organisations across five continents. The advisory was produced by CISA with the Department of Defense's Cyber Crime Center, the FBI, the NSA, the Secret Service and the Republic of Korea's National Police Agency, and CyberScoop reports it as part of the ongoing FBI-CISA defender series. Victim-count figures differ by source and by date: Tech Times reports that CISA documents 51 breached organisations, while TechNadu, citing AhnLab, puts Gunra's own claimed total at 32 global victims as of March 2026. Separately, Tech Times reports that Gunra's Linux encryption is breakable via file timestamps and that Linux victims should not pay, a claim no other source in this set corroborates.
None of the sources available for this brief are the advisory document itself. Everything below is attributed to the outlet or vendor that published it.
What Happened
The FBI first took notice of Gunra in April 2025, according to CyberScoop's reading of the advisory. The group set up a Tor-based data leak site to name victims and publish stolen files, following the standard double-extortion template: encrypt, exfiltrate, then threaten publication if the ransom goes unpaid.
By January 2026 the operation had industrialised. CyberScoop reports the advisory as stating that Gunra launched a formal ransomware-as-a-service affiliate programme, and that "the FBI observed the group adopting new branding aliases (notably operating under the name Golden Community) to support this expansion." The same alert describes Gunra actively recruiting penetration testers and ethical hackers to work as initial access brokers, offering them a cut of ransom proceeds in exchange for enterprise network access.
Targeting is broad rather than sector-specific. CyberScoop lists academia, financial services and insurance, government services and facilities, healthcare, manufacturing and construction, media, retail, transportation and utilities, with victims across Africa, the Americas, the Asia-Pacific, Europe and the Middle East. Chris Butera, acting assistant director for cybersecurity at CISA, is quoted saying Gunra is "another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations."
Individual leak-site claims tracked by third parties fill in the shape of that spread, though none carry victim confirmation. Dark Eye records Yuditec S.A., a small Uruguayan IT firm of under 50 staff, as claimed by Gunra with a leak-site publication date of 30 June 2026. Undercode News reports that Gunra listed PT All Cosmos Biotek, an Indonesian agricultural biotechnology and fertiliser company, and separately that ThreatMon monitoring detected Gunra adding a victim identified as Weilhotel on 29 July 2026. All three are single-source, leak-site-derived claims and should be treated as unverified allegations by the attacker, not confirmed breaches.
What Was Taken
Volume figures are not established in any source here. What is documented is the category of data and the proof the operators have chosen to publish.
Dark Eye's record for Yuditec S.A. lists proof-of-breach screenshots posted by the operator including a file tree, a spreadsheet named finance_2024.xlsx, a passport scan and a signed contract. That mix of financial records, identity documents and executed contracts is characteristic of Gunra's exfiltration-first posture and is what gives the extortion leverage its bite for small organisations with no capacity to absorb a public dump.
For the Indonesian agri-biotech case, Undercode News is explicit that publicly available information does not confirm the attack method, the volume of stolen data, or whether encryption occurred. The same caveat applies to the Weilhotel listing. AhnLab's technical report describes Gunra's activity against Korean targets in general terms: encrypting files and exfiltrating sensitive organisational information, without record counts.
The one datapoint worth flagging is a disclosure gap. Dark Eye's timeline for Yuditec shows a leak-site discovery date of 30 June 2026 against a disclosure date of 4 May 2026, which the platform renders as a negative 57-day window. That ordering is internally inconsistent and looks like a data-quality artefact in the tracker rather than a meaningful exposure metric. It should not be cited as a breach timeline.
Why It Matters
Two things separate this campaign from routine RaaS churn.
The first is the North Korean overlap. AhnLab's ASEC published a technical report alongside a joint advisory from four South Korean agencies: the National Intelligence Service, the National Police Agency, KISA and the Financial Security Institute. The Record and TechNadu both report that AhnLab found a state-sponsored group widely tracked as Lazarus and the Gunra ransomware operation running parallel campaigns against South Korean targets from 2025 through the first half of 2026, differing only in end goal. The state-linked side installed espionage backdoors in at least 72 organisations in 2026 alone, including government agencies, cryptocurrency exchanges and IT service providers. Gunra used comparable access to encrypt and extort. CyberScoop reports the US-ROK advisory as noting that Gunra benefits from North Korean government-linked hackers' tools.
Crucially, nobody has made a hard attribution. ASEC's own wording is that the two appear to be separate threat actors with different objectives who "may have shared certain techniques, tools, and infrastructure or collaborated to a limited extent." The Record notes AhnLab classified the cases as having "a high likelihood of technical linkage" requiring continued investigation, and named the campaign Operation Double Barrel without merging the two actors. Collaboration, shared infrastructure and access brokering all remain live explanations.
The second is the recovery question. Tech Times frames the Linux encryption as breakable via file timestamps, which cuts both ways: it implies free decryption may be possible for some Linux and ESXi victims, and it implies the key handling is unreliable enough that a paid decryptor may not restore data. Treat this as a single-source claim and verify against the advisory text and law enforcement directly before it drives an incident decision. If it holds, the operational rule is that paying buys nothing on the encryption side, and only ever addresses the leak threat.
The recruitment model matters strategically too. Paying penetration testers for access converts legitimate offensive-security skill into a supply chain for extortion, which raises the baseline tradecraft of the average intrusion well above commodity affiliate work.
The Attack Technique
The clearest initial-access picture comes from the Korean cases. ASEC reports that both the state-sponsored actor and Gunra exploited vulnerabilities in Korean financial security software, the kind installed as a practical requirement for using Korean banking and government services. Victims were driven to malicious URLs through watering-hole and spear-phishing attacks, and the vulnerabilities were then exploited to install backdoor malware. ASEC confirmed that legitimate Korean websites across media, education, healthcare and manufacturing were abused as watering holes during this period. AhnLab's report warns that the abused software "is used not only in various enterprise environments but also on many personal PCs," which widens the exposed surface considerably.
The overlap indicators AhnLab documented across the two campaigns are unusually specific: identical malware filenames and execution arguments, the same privilege escalation tools, the same command-and-control servers, the same download and reverse-tunnelling addresses, and a matching SSH key fingerprint. The Record notes both operations even cleaned up identically, renaming malware files to random four-character strings before wiping them.
Beyond Korea, the access route is the affiliate model itself. CyberScoop's account of the advisory describes brokered enterprise access sold in for a share of the ransom, meaning entry technique will vary by affiliate rather than following one signature. The Linux and ESXi encryptor variant is the payload most relevant to virtualisation estates, where a single hypervisor compromise takes down every guest at once.
What Organizations Should Do
- Do not pay on the strength of a promised Linux or ESXi decryptor. Tech Times reports the Linux encryption as flawed and breakable via file timestamps. Before making any payment decision, contact the FBI or your national CERT, confirm the current decryptor status against the joint advisory itself, and ask whether a free recovery path exists for your variant.
- Preserve encrypted data and full forensic artefacts even if you have clean backups. If timestamp-based decryption is viable, it depends on filesystem metadata that aggressive remediation will destroy.
- Harden the virtualisation layer specifically. Isolate ESXi management interfaces from general network access, enforce MFA on hypervisor and vCenter administration, disable SSH on hosts when it is not actively in use, and keep at least one backup copy offline and outside the hypervisor's reach.
- If you operate in or through South Korea, audit endpoints for the mandatory Korean financial security software AhnLab flagged, patch it to current, and hunt for the Operation Double Barrel indicators in ASEC's report, particularly the shared C2 addresses and SSH key fingerprint.
- Hunt for the shared tradecraft rather than a single family signature. Alert on privilege escalation tooling, reverse tunnelling to external addresses, and file deletion patterns involving renaming to short random strings before removal.
- Assume the initial access broker is not the operator. Treat any credential compromise, exposed remote access service or unexplained VPN session as a potential presale of your network, and review external-facing authentication logs on that basis.
- Build the response plan around data exfiltration, not just encryption. Gunra's leverage comes from the leak site, and the proof samples posted for smaller victims show finance records, identity documents and contracts. Decide now who makes the disclosure call and on what timeline.
Sources: Gunra Ransomware Hit Hospitals and Governments; Linux Victims Shoul... | U.S., South Korean government agencies caution to be on ... | North Korea’s Lazarus Group sharing tools with ransomware hackers,... | Yuditec S.A. — GUNRA Ransomware Attack Dark Eye | Gunra Ransomware Targets Indonesian Agricultural Biotechnology Firm... | North Korean Hackers Share Tools With Gunra Ransomware, AhnLab Find... | Ransomware Groups Gunra and Deadlock Expand Victim Lists, Highlight... | Joint Cybersecurity Advisory Operation Double Barrel (The Relations...