A collective of leading cybersecurity agencies, including the **Federal Bureau of Investigation (FBI)**, **Cybersecurity and Infrastructure Security Agency (CISA)**, **Department of Defense Cyber Crime Center (DC3)**, **National Security Agency (NSA)**, **U.S. Secret Service (USSS)**, and the **Republic of Korea’s National Police Agency (KNPA)**, has issued a joint advisory under the #StopRansomware initiative. The advisory highlights the escalating threat posed by **Gunra** ransomware, urging organizations to bolster their defenses. ### Gunra: From Variant to RaaS Powerhouse **Gunra** first surfaced in April 2025 as a potent ransomware variant. By early 2026, it had transformed into a sophisticated Ransomware-as-a-Service (RaaS) program, actively recruiting affiliates on dark web forums. This expansion includes offering a management panel, a configurable ransomware builder, cross-platform locker payloads, and comprehensive affiliate documentation. Notably, **Gunra** has adopted new branding aliases, such as "Golden Community," to support its commercialization efforts. The group is even actively recruiting penetration testers and ethical hackers to serve as initial access brokers, offering a share of the ransom profits for successful enterprise network access. ### Double Extortion: The Gunra Modus Operandi **Gunra** actors leverage a classic double-extortion model. Before encrypting data, they exfiltrate sensitive victim information. Should the ransom remain unpaid, this data is then threatened to be published on a dedicated leak site (DLS) hosted on the **Tor** network. Victims receive a ransom note in every affected directory, directing them to a **Tor**-based negotiation portal where they are assigned a Client ID and an initial password. Further instructions guide victims to contact the **Gunra** actors via **qTox**, an encrypted messaging application, to negotiate payments. ### Widespread Impact Across Critical Sectors The advisory indicates that **Gunra** has already claimed victims across multiple sectors and continents, including the Americas, Europe, the Middle East, Africa, and the Asia-Pacific. Targeted sectors include: * Healthcare and public health * Financial services and insurance * Critical manufacturing and construction * Transportation systems and logistics * Government services and facilities * Utilities * Academia * Media and communications * Retail * Professional and nonprofit services ### Key Mitigations to Counter Gunra The authoring agencies strongly recommend that organizations implement the following critical mitigations to protect against **Gunra** and similar ransomware threats: * **Prioritize patching known exploited vulnerabilities** in internet-facing systems, particularly **Virtual Private Network (VPN)** gateways and **Remote Desktop Protocol (RDP)**-exposed infrastructure. * **Implement and rigorously test offline, immutable backups**. These backups should be stored in a physically separate, segmented location to ensure recoverability without succumbing to ransom demands. * **Segment networks** to restrict lateral movement. This prevents an initially compromised device from spreading malware to other systems within the organization. ### Indicators of Compromise For a downloadable copy of Indicators of Compromise (IOCs), organizations can access: * [AA26-222A STIX XML](https://www.cisa.gov/sites/default/files/2026-08/AA26-222A-stix.xml) * [AA26-222A STIX JSON](https://www.cisa.gov/sites/default/files/2026-08/AA26-222A-stix.json) This advisory serves as a vital resource for cybersecurity architects, defensive cybersecurity analysts, vulnerability analysts, systems administrators, and security systems managers in government, critical infrastructure, and other at-risk organizations. The ongoing #StopRansomware effort aims to provide network defenders with detailed information on various ransomware variants, their tactics, techniques, and procedures (**TTPs**), and IOCs to enhance protection against these evolving threats.