Gunra

What the sources describe

CISA and partners issued a joint advisory detailing Gunra ransomware’s evolving tactics and double-extortion operations. AttackIQ emulations help organizations validate defenses against the adversary behaviors observed in Gunra attacks. The post Response to CISA Advisory (AA26-222A): #StopRansomware: Gunra Ransomware appeared first on AttackIQ . On August 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Defense Cyber Crime Center (DC3), National Security Agency (NSA), U.S. Secret Service (USSS), and Republic of Korea’s National Police Agency (KNPA) released a joint advisory to alert organizations to the emerging Gunra ransomware threat and to provide detection and mitigation guidance. This joint CSA is part of CISA’s ongoing #StopRansomware effort to provide defenders with intelligence and recommendations to help organizations identify, mitigate, and respond to ransomware activity. Gunra is a ransomware strain that emerged in April 2025. Developed in C/C++ and reportedly derived from leaked Conti ransomware source code, Gunra has since been observed targeting organizations across multiple industries. In early 2026, the group expanded its operations through a structured ransomware-as-a-service (RaaS) affiliate program advertised on underground forums. The program provides affiliates with access to a management panel, configurable ransomware builders, cross-platform payloads, and supporting documentation. Gunra operates a double-extortion model in which sensitive data is exfiltrated before systems are encrypted, with victims threatened with publication of their stolen information through a dedicated data leak site. Ransom negotiations are conducted through a Tor-based portal. According to the advis

Gunra Ransomware, un RaaS derivato da Conti1, è attivo con picco operativo tra l'agosto 2026. Colpisce multi-settorialmente aree come Sanità e Servizi Finanziari in tutto il mondo, utilizzando tecniche di initial access (T1190) e doppia estorsione.

Advisory at a Glance Title #StopRansomware: Gunra Ransomware Original Publication August 10, 2026 Executive Summary Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid. This advisory provides technical details of the activity, as well as tailored detection and mitigation guidance to protect at-risk organizations from Gunra. Key Actions Prioritize patching known exploited vulnerabilities in internet-facing systems , including virtual private network (VPN) gateways and remote desktop protocol (RDP)-exposed infrastructure. Implement and test offline, immutable backups stored in a physically separate, segmented location to ensure recoverability without ransom payment. Segment networks to restrict lateral movement from an initially compromised device to other systems in the organization. Indicators of Compromise For a downloadable copy of indicators of compromise, see: AA26-222A STIX XML (54 KB) AA26-222A STIX JSON (61 KB) Intended Audience Organizations: Government, Critical Infrastructure Sectors: Healthcare and public health , financial services and insurance, critical manufacturing and construction, transportation systems and logistics, government services and facilities , utilities, academia, media and communications, retail, and professional and nonprofit services. Roles: Cybersecurity architects , defensive cybersecurity analysts , vulnerability analysts , systems administrators , and security systems managers . Introduction Note: T