Gunra ransomware began operations in April 2025, expanded to RaaS by January 2026
A joint advisory from the FBI, CISA, NSA and partners documents the group's exploitation of Fortinet flaws, double-extortion tactics, and evolution from targeted attacks to affiliate-based operations.
Disclaimer
This article was produced by Scroll Insights News Desk using automated systems and published under our standing editorial policy. It is compiled from the primary sources linked above and is provided for general information only — it is not legal, financial, investment, tax or professional advice, and no decision should be taken on it without independent verification against those sources. Errors can be reported to corrections@scrollinsights.com and are corrected on the record.
Gunra ransomware first appeared in April 2025 and by January 2026 launched a formal ransomware-as-a-service affiliate program on dark web forums, expanding from targeted attacks to an affiliate model under the branding alias Golden Community.
The FBI, CISA, NSA and five other government agencies released this advisory on August 10, 2026, documenting Gunra's operational techniques, infrastructure, and financial demands. Gunra victims span organizations in the Americas, Europe, Middle East, Africa, and the Asia-Pacific regions.
Exploitation method and persistence
Gunra actors exploited CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities in FortiOS and FortiProxy. Both flaws allow threat actors to create a malicious user account forticloud-sync with super user privileges and a hard-coded password on vulnerable Fortinet firewall devices. Once inside, Gunra actors downloaded OpenSSH from external attacker-controlled servers to establish connections and maintain persistence across victim networks.
Lateral movement and data exfiltration
Gunra actors used Impacket libraries psexec.py and smbclient.py to move laterally using the Server Message Block protocol and conducted OS credential dumping via secretsdump.py against compromised domain controllers. A malicious executable called main.exe exfiltrates victim data from Microsoft OneDrive and SharePoint; for at least one victim, actors exfiltrated data volumes up to tens of terabytes to the file-sharing service Mega. Against one victim, actors deleted backup and archived data stored on backup infrastructure at both primary data center and disaster recovery center, eliminating recovery options before encryption.
Encryption and ransom demands
Gunra uses ChaCha20 + RSA-4096 encryption with multi-threaded architecture for parallel file encryption. Windows Management Instrumentation initiates deletion of volume shadow copies prior to encryption. Gunra renames encrypted files with the extension .ENCRT and writes a static ransom note named R3ADM3.txt to each directory after completing encryption. Victims receive ransom notes in every affected directory and are assigned a Client ID and initial password on a Tor-based negotiation portal.
Gunra actors generally start ransom negotiations at arbitrarily high amounts over tens of millions in US dollars and give victims five to seven days to negotiate via qTox encrypted messaging application. Between June and July 2025, Gunra operated a clearnet mirror of their Tor-based dedicated leak site at domain datapub.news. By March 2026, Gunra moved their original Tor-based dedicated leak site to a different .onion address.
Operational patterns
Gunra actors typically conduct malicious activities during late-night and early-morning hours from 10:00 p.m. to 06:00 a.m. Gunra ransomware binary includes the IsDebuggerPresent API to detect if the application is being run in a debugger. Gunra excludes common system directories such as C:\Windows, C:\Program Files, and C:\Program Files (x86) from file system reconnaissance, and excludes file extensions related to system-critical files such as .exe, .dll, and .sys from encryption.
Gunra initially focused on Windows environments and introduced a Linux variant in mid-2025. Gunra is based on or significantly influenced by Conti ransomware source code that was leaked in 2022.