U.S., South Korea Warn of Gunra Ransomware Threat to Critical Infrastructure

U.S. and South Korean authorities issued a joint cybersecurity advisory on Monday, August 10, 2026, warning of a significant and evolving threat from the Gunra ransomware group, which is actively targeting government agencies and critical infrastructure worldwide. The alert, part of the FBI and CISA's StopRansomware series, details the group's sophisticated attack methods and urges organizations to strengthen their defenses immediately.

The advisory, released by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency, the U.S. Secret Service, the Department of Defense Cyber Crime Center, and South Korea's National Police Agency, identifies Gunra as a ransomware-as-a-service operation that first emerged in April 2025. The group is believed to be built on source code from the leaked Conti ransomware. By January 2026, Gunra had matured into a full affiliate model, actively recruiting penetration testers and ethical hackers as initial access brokers on dark web forums, offering them a share of ransom profits.

According to the advisory, Gunra actors gain initial access primarily by exploiting known vulnerabilities in internet-facing VPN and...