FBI and South Korea Warn Gunra Ransomware Is Targeting Critical Infrastructure
Summary
U.S. and South Korean authorities say Gunra has exploited two Fortinet flaws to access organizations, steal and encrypt data, and extort victims. Their advisory describes global targeting and a Linux-variant weakness that may enable file recovery.
Key points
- Authorities say Gunra actors exploited Fortinet vulnerabilities CVE-2024-55591 and CVE-2025-24472 to gain privileged access, steal data, encrypt systems, and extort organizations.
- The FBI and South Korea’s police agency reported Gunra activity affecting healthcare, financial services, and government organizations globally.
- In most cases described, victims received ransom demands exceeding $10 million and five to seven days to pay; the FBI observed attempts to contact victim-company managers directly, with limited success.
- The FBI said it first observed Gunra and its leak site in April 2025. The advisory describes the operation as built using leaked Conti ransomware source code.
- The FBI said Gunra shifted to a ransomware-as-a-service model and recruited members, including initial access brokers; it has also used the alias “Golden Community.”
- Gunra moved from Windows to a Linux variant. Researchers found a weakness that may let defenders reconstruct keys from file timestamps and recover files without paying.
Article Details
- Event Type
- U.S. and South Korean authorities warned that the Gunra ransomware group is exploiting Fortinet firewall vulnerabilities to breach critical infrastructure organizations.
- Impact
- Gunra steals and encrypts victim data and demands ransom payments; victims were reportedly given demands exceeding $10 million and five to seven days to pay. The group has targeted healthcare, financial services, and government organizations globally. Researchers found a weakness in Gunra’s Linux variant that can allow defenders to recover files without paying.
CVE
CVE-2024-55591The agencies warned that Gunra actors have been exploiting CVE-2024-55591 and CVE-2025-24472 — two vulnerabilities affecting popular firewall products from Fortinet that CISA previously warned about — to gainCVE-2025-24472The agencies warned that Gunra actors have been exploiting CVE-2024-55591 and CVE-2025-24472 — two vulnerabilities affecting popular firewall products from Fortinet that CISA previously warned about — to gain
People
Threat Actors
Golden CommunityThe FBI reported that Gunra used this name as an alias while expanding and recruiting hackers as initial access brokers.GunraAuthorities reported that the ransomware group exploited Fortinet firewall vulnerabilities to gain privileged access, steal and encrypt data, and extort victims.Lazarus GroupResearchers warned that some tools and infrastructure used by Lazarus Group appeared to have been shared with Gunra as it targeted South Korean organizations; the reported relationship is not stated as confirmed.
Malware
Contiand South Korean authorities warned that Gunra, a Conti-derived operation, is expanding globally and targeting healthcare, financial services, and government sectors.GunraThe Gunra ransomware group is exploiting Fortinet firewall vulnerabilities to breach critical infrastructure organizations, steal data, and encrypt systems before demanding multi-million-dollar ransoms.
Vendors
Countries
Industries
Financial Servicesand South Korean authorities warned that Gunra, a Conti-derived operation, is expanding globally and targeting healthcare, financial services, and government sectors.Governmentand South Korean authorities warned that Gunra, a Conti-derived operation, is expanding globally and targeting healthcare, financial services, and government sectors.Healthcareand South Korean authorities warned that Gunra, a Conti-derived operation, is expanding globally and targeting healthcare, financial services, and government sectors.IndustrialThe advisory comes as industry groups warn that ransomware incidents continue to increase, particularly those targeting critical industrial organizations.