U.S. and South Korea Warn of Gunra Ransomware Targeting Government, Critical Infrastructure
Summary
A joint U.S. and South Korean advisory warns that Gunra targets government and critical infrastructure, exploits Fortinet flaws and other access weaknesses, and has expanded to Linux and a RaaS model. Defenders are urged to patch, segment networks and keep offline data.
Key points
- U.S. federal agencies and South Korea’s National Policy Agency warned that Gunra targets government and critical infrastructure organizations worldwide.
- The advisory says Gunra’s ransomware is based on leaked Conti source code and that the FBI observed actors contacting victims’ management to demand ransom.
- Gunra actors have exploited FortiOS and FortiProxy authentication vulnerabilities CVE-2024-55591 and CVE-2025-24472, as well as credential-exposure and SSH access-control weaknesses in internet-facing VPN gateways.
- After initially focusing on Windows, Gunra expanded to cross-platform operations with a Linux variant introduced in mid-2025.
- Since January 2026, Gunra has operated a RaaS program and recruited initial access brokers; the advisory says the group has also used the alias Golden Community.
- A separate advisory from AhnLab and South Korean government agencies reported possible links between Gunra and Lazarus Group.
- The agencies advised defenders to patch known exploited vulnerabilities, segment networks to limit lateral movement and maintain offline backups.
Article Details
- Event Type
- Joint U.S. and South Korean warning about Gunra ransomware attacks
- Impact
- Gunra has targeted government and critical infrastructure organizations worldwide, including healthcare and public health, financial, and government services. The attacks use Fortinet firewall vulnerabilities and other access flaws to enter networks, and the ransomware operates across Windows and Linux. The advisory describes double extortion and a RaaS program.
MITRE ATT&CK
CVE
CVE-2024-55591on their targets’ networks using exploits targeting two critical authentication vulnerabilities (CVE-2024-55591 and CVE-2025-24472) in FortiOS and FortiProxy software.CVE-2025-24472networks using exploits targeting two critical authentication vulnerabilities (CVE-2024-55591 and CVE-2025-24472) in FortiOS and FortiProxy software.
Threat Actors
Golden CommunityThe advisory says Gunra adopted Golden Community as a branding alias in connection with its RaaS expansion.GunraThe advisories describe Gunra as a ransomware group targeting organizations worldwide and exploiting Fortinet firewall flaws and other access weaknesses. The FBI observed the group attempting to solicit ransom payments from victim-company management by email.Lazarus GroupA South Korean advisory reportedly exposed links between Gunra and Lazarus Group; the article describes this as a possible link, not confirmed attribution.
Malware
Contithat Gunra ransomware is targeting government and critical infrastructure organizations worldwide, using Conti-based code, Fortinet firewall exploits, and other access flaws to spread across Windows and Linux systems.Gunraand South Korean agencies warned that Gunra ransomware is targeting government and critical infrastructure organizations worldwide, using Conti-based code, Fortinet firewall exploits, and other access flaws to spread
Vendors
Products
Industries
Critical infrastructureand South Korean agencies warned that Gunra ransomware is targeting government and critical infrastructure organizations worldwide, using Conti-based code, Fortinet firewall exploits, and other access flaws to spreadGovernmentand South Korean agencies warned that Gunra ransomware is targeting government and critical infrastructure organizations worldwide, using Conti-based code, Fortinet firewall exploits, and other access flaws to spreadHealthcare and public healthcode leaked in February 2022, in attacks targeting a wide range of industry sectors, from healthcare and public health to financial and government services.