U.S. and South Korean Agencies Warn of Gunra Ransomware Expansion

Summary

A joint U.S. and South Korean advisory says Gunra is expanding its ransomware-as-a-service operation, recruiting penetration testers as initial access brokers and targeting government and critical infrastructure organizations worldwide.

Key points

• A joint advisory from U.S. and South Korean agencies warns that Gunra is expanding its ransomware-as-a-service operation.
• The FBI first took notice of Gunra in April of the prior year; the group launched a formal affiliate program by January, according to the advisory.
• Gunra reportedly recruits penetration testers and ethical hackers as initial access brokers, offering a share of ransom profits.
• The agencies say Gunra seeks access through known vulnerabilities in internet-facing firewalls and VPN devices.
• Gunra operates under the Golden Community alias and maintains a Tor data leak site, according to the advisory.
• The agencies say Gunra's ransomware is based on or influenced by leaked Conti code. A South Korean firm's research noted possible overlap with Lazarus Group, but the relationship is not confirmed.

MITRE ATT&CK

People

Threat Actors

Malware

Industries

Related Articles

• U.S. and South Korea Warn of Gunra Ransomware Targeting Government, Critical Infrastructurebleepingcomputer.comConti · Golden Community · Gunra · Lazarus Group · T1190
• FBI and South Korea Warn Gunra Ransomware Is Targeting Critical Infrastructuretherecord.mediaConti · Golden Community · Gunra · Lazarus Group
• Joint Advisory Details Gunra Ransomware Intrusions and Linux Recovery Weaknesscisa.govConti · Golden Community · Gunra · T1190
• Lazarus Operation FlashHole Abuses South Korean Security Software in Multistage Campaignsecurelist.comGunra · Lazarus Group
• PHP2Shell Exploitation Targets European Government as Global Scanning Expandsthehackernews.comLazarus Group · T1190