Joint Advisory Details Gunra Ransomware Intrusions and Linux Recovery Weakness
Summary
A joint agency advisory details Gunra ransomware’s VPN exploitation, credential theft, MFA bypass and double extortion. It also describes a Linux encryption weakness that may allow recovery and recommends patching, segmentation and isolated backups.
Key points
- According to the advisory, Gunra emerged in April 2025 and launched a formal ransomware-as-a-service program in January 2026, also using the Golden Community name.
- FBI and KNPA observations link initial access to vulnerable internet-facing firewall and VPN appliances, exposed credentials and default administrator credentials without account lockout controls.
- In one investigated intrusion, actors captured VDI authentication traffic, reused session cookies and modified authentication files so an attacker-selected OTP bypassed MFA.
- Actors used Impacket for lateral movement and domain-controller credential dumping; in one case, a stolen Hiware encryption key enabled decryption of stored enterprise server passwords.
- The FBI observed a malicious main.exe application exfiltrating OneDrive and SharePoint data. Gunra also used archived data transfers to Mega as part of its double-extortion operations.
- The advisory describes parallel ChaCha20 and RSA-4096 encryption, alongside shadow-copy deletion and, in one victim case, destruction of primary and disaster-recovery backups.
- Researchers cited in the advisory identified predictable time-seeded key generation in Linux .GNRA variants that may permit recovery using file timestamps. Agencies recommend preserving artifacts, patching exposed systems, segmenting networks and testing offline immutable backups.
Article Details
- Attack Vectors
- Exploitation of internet-facing firewall and VPN appliances, including vulnerabilities that enable creation of a persistent privileged account on FortiOS.
- Use of default SSL-VPN administrator credentials where account lockout controls were absent.
- Capture of VDI credentials and session cookies through manipulated SSL-VPN traffic controls, followed by session hijacking and RDP lateral movement.
- Modification of VDI authentication processing files to accept an attacker-chosen OTP and bypass MFA.
- Credential dumping from domain controllers and decryption of enterprise server passwords using a stolen Hiware encryption key.
- Data theft before ransomware deployment, followed by encryption and threats to publish or sell stolen data.
- Defensive Notes
- Prioritize patching known exploited vulnerabilities in internet-facing VPN, firewall, and remote-access infrastructure.
- Maintain and test offline, immutable backups in a physically separate, segmented location; protect both primary and disaster recovery backups from deletion.
- Segment networks, enforce least privilege, audit privileged and newly created accounts, and require MFA for remote access and critical systems.
- Investigate anomalous appliance administration, authentication changes, archive creation, and use of dual-use remote-access or exfiltration tools.
- Isolate compromised hosts and collect logs, ransom notes, account activity, and other forensic evidence before selecting eviction measures.
- For affected Linux ELF variants using .GNRA, preserve encrypted files and timestamps: researchers reported that predictable time-seeded PRNG output may allow encryption-key reconstruction and file recovery.
- Vet listed infrastructure before blocking because the advisory warns that some indicators are historical.
- Validate security controls against the observed behaviors and restrict unnecessary command-line and scripting permissions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | datapub[.]news | Gunra clearnet leak-site mirror used between June and July 2025. |
4569f6322bc3b22e9@proton[.]me | Gunra ransom negotiation address. | |
6449a3c1e612168526@proton[.]me | Gunra ransom negotiation address. | |
a00f105546345756@proton[.]me | Gunra ransom negotiation address. | |
ilovemycubscout@gmail[.]com | Gunra ransom negotiation address. | |
| IPV4 | 103[.]125[.]234[.]14 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 123[.]184[.]143[.]105 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 123[.]244[.]187[.]144 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 123[.]246[.]37[.]108 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 182[.]204[.]16[.]112 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 182[.]204[.]21[.]240 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 182[.]204[.]39[.]118 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 211[.]21[.]210[.]181 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 23[.]239[.]119[.]2 | Gunra infrastructure observed from July through November 6, 2025; potentially historical. |
| IPV4 | 23[.]239[.]119[.]3 | Gunra infrastructure observed from July through November 6, 2025; potentially historical. |
| IPV4 | 23[.]239[.]119[.]4 | Gunra infrastructure observed from July through November 6, 2025; potentially historical. |
| IPV4 | 23[.]239[.]119[.]5 | Gunra infrastructure observed from July through November 6, 2025; potentially historical. |
| IPV4 | 23[.]239[.]119[.]6 | Gunra infrastructure observed from July through November 6, 2025; potentially historical. |
| IPV4 | 67[.]43[.]53[.]10 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 70[.]36[.]99[.]82 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| IPV4 | 86[.]54[.]28[.]216 | Gunra infrastructure observed from June 7 through July 23, 2025; potentially historical. |
| IPV4 | 91[.]201[.]66[.]146 | Gunra infrastructure observed in November–December 2025; potentially historical. |
| SHA256 | 2dc70a12d158d437e45a55b1d52f3d61c6082a1e1667573302ba3b62813e2751 | Malicious main.exe used to exfiltrate OneDrive and SharePoint data. |
| SHA256 | 834efe9b392c6c000877ea5613a079445affc16fe8af5997d68c55cafc95e5d1 | Malicious main.exe used to exfiltrate OneDrive and SharePoint data. |
| SHA256 | 91f8fc7a3290611e28a35a403fd815554d9d856006cc2ee91ccdb64057ae53b0 | Malicious cryptor.exe associated with Gunra ransomware. |
| SHA256 | a82e496b7b5279cb6b93393ec167dd3f50aff1557366784b25f9e51cb23689d9 | Malicious msmp.exe associated with Gunra ransomware. |
MITRE ATT&CK
T1003.003 · NTDSActors used secretsdump.py against domain controllers to extract account hashes from NTDS files.T1021.001 · Remote Desktop ProtocolActors moved through internal VDI, authentication servers, AD infrastructure, and IT desktops using RDP.T1021.002 · SMB/Windows Admin SharesGunra used Impacket psexec.py and smbclient.py for SMB-based lateral movement.T1040 · Network SniffingActors manipulated SSL-VPN traffic controls to capture VDI authentication credentials and session information.T1047 · Windows Management InstrumentationGunra used WMIC shadowcopy deletion commands before encryption.T1078.001 · Default AccountsActors obtained SSL-VPN administrator access using default credentials where lockout controls were absent.T1098 · Account ManipulationActors modified an unused account to bypass its mandatory password-change requirement.T1190 · Exploit Public-Facing ApplicationGunra exploited internet-facing firewall and VPN appliances for initial access.T1486 · Data Encrypted for ImpactGunra encrypted victim files using ChaCha20 and RSA-4096, including database servers and NAS systems.T1490 · Inhibit System RecoveryActors deleted volume shadow copies and removed backup and archived data at primary and disaster recovery facilities.T1530 · Data from Cloud StorageMalicious main.exe collected data from OneDrive and SharePoint for exfiltration.T1539 · Steal Web Session CookieActors stole VDI session cookies to hijack authenticated sessions and impersonate users.T1556.006 · Multi-Factor AuthenticationActors modified VDI authentication files so an attacker-selected OTP bypassed MFA.T1567 · Exfiltration Over Web ServiceActors exfiltrated compressed sensitive data to Mega, reportedly reaching tens of terabytes.T1572 · Protocol TunnelingActors used downloaded OpenSSH to establish persistent tunnels between compromised systems.
CVE
CVE-2024-55591CVE-2024-55591 and CVE-2025-24472 allow threat actors to exploit scheduled tasks on vulnerable FortiOS firewall devices to create a new, malicious persistent user forticloud-sync with super user privileges and aCVE-2025-24472CVE-2024-55591 and CVE-2025-24472 allow threat actors to exploit scheduled tasks on vulnerable FortiOS firewall devices to create a new, malicious persistent user forticloud-sync with super user privileges and a
Threat Actors
Golden CommunityBranding alias the FBI observed Gunra adopting during its expansion into RaaS; the reported operation steals data and encrypts victim systems for extortion.GunraThe authoring agencies report a double-extortion ransomware operation that expanded into RaaS in 2026, exploiting edge devices, stealing data, and encrypting systems. The FBI observed it adopting the branding alias Golden Community.
Malware
Vendors
Products
Fortinet FortiGateGunra actors exploited vulnerabilities in FortiGate firewall and SSL-VPN appliances to gain initial access to victim networks.FortiOSCVE-2024-55591 and CVE-2025-24472 allow threat actors to exploit scheduled tasks on vulnerable FortiOS firewall devices to create a new, malicious persistent user forticloud-sync with super user privileges and aHiwareAdditionally, the actors accessed a Hiware system access control server via SSH from a compromised virtual desktop and stole a symmetric encryption key stored on the server.Linuxactors’ campaigns focused on Windows environments; reporting in mid-2025 indicated the group introduced a Linux variant and moved toward broader cross-platform targeting.5 Microsoft OneDriveThe FBI observed Gunra actors use a malicious executable (main.exe) to exfiltrate victim data from Microsoft OneDrive and SharePoint [T1530].Microsoft SharePointThe FBI observed Gunra actors use a malicious executable (main.exe) to exfiltrate victim data from Microsoft OneDrive and SharePoint [T1530].Microsoft Windowsby, the Conti ransomware source code leaked in 2022.4 Initially, Gunra actors’ campaigns focused on Windows environments; reporting in mid-2025 indicated the group introduced a Linux variant and moved toward
Tools
7-ZipGunra infrastructure that Gunra actors use to facilitate collection and exfiltration of data, including 7-Zip, RClone, and FileZilla [T1048] (see Leveraged Tools for a full list of tools used maliciously by GunraAnyDeskCommon, legitimate remote monitoring and management (RMM) tool that can be used by a cyber actor to obtain remote access and maintain persistence. AnyDesk also supports remote file transfer.FileZillathat Gunra actors use to facilitate collection and exfiltration of data, including 7-Zip, RClone, and FileZilla [T1048] (see Leveraged Tools for a full list of tools used maliciously by Gunra actors).ImpacketGunra relies on credential theft, session hijacking, and lateral movement with Impacket and RDP.OpenSSHThe actors subsequently downloaded OpenSSH (an SSH tunneling tool) [T1105] from an external attacker-controlled server to establish connections between compromised systems and maintain persistence in the victim’sRCloneinfrastructure that Gunra actors use to facilitate collection and exfiltration of data, including 7-Zip, RClone, and FileZilla [T1048] (see Leveraged Tools for a full list of tools used maliciously by Gunra actors).WinRARGunra actors were observed utilizing tools such as 7-Zip, WinRAR, RClone, and others to copy and archive victim data for exfiltration.
Industries
Academiaand construction, transportation systems and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services.Critical infrastructureGunra is a ransomware-as-a-service operation that uses double extortion to target government, critical infrastructure, and other organizations, combining data theft with file encryption.critical manufacturing and constructionSectors: Healthcare and public health, financial services and insurance, critical manufacturing and construction, transportation systems and logistics, government services and facilities, utilities, academia, media andFinancial services and insuranceSectors: Healthcare and public health, financial services and insurance, critical manufacturing and construction, transportation systems and logistics, government services and facilities, utilities, academia, media andGovernmentGunra is a ransomware-as-a-service operation that uses double extortion to target government, critical infrastructure, and other organizations, combining data theft with file encryption.Healthcare and public healthSectors: Healthcare and public health, financial services and insurance, critical manufacturing and construction, transportation systems and logistics, government services and facilities, utilities, academia, media andmedia and communicationstransportation systems and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services.professional and nonprofit servicesservices and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services.Retailsystems and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services.transportation systems and logisticspublic health, financial services and insurance, critical manufacturing and construction, transportation systems and logistics, government services and facilities, utilities, academia, media and communications,Utilitiesand construction, transportation systems and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services.