#StopRansomware: Gunra Ransomware
Publication: August 10, 2026
U.S. Federal Bureau of Investigation
U.S. Cybersecurity and Infrastructure Security Agency
U.S. Department of Defense Cyber Crime Center
U.S. National Security Agency
U.S. Secret Service
Republic of Korea’s National Police Agency
To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact the FBI’s Internet
Crime Complaint Center (IC3), your local FBI field office, your local USSS field office, and/or CISA’s 24/7 Operations Center at
contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). When available, please include the following information regarding
the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the
activity; the name of the submitting company or organization; and a designated point of contact. For NSA-client cybersecurity
guidance inquiries, contact
CybersecurityReports@nsa.gov.
This document is distributed as TLP:CLEAR. Disclosure is not limited. Sources may use TLP:CLEAR when information carries
minimal or no forseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to
standard copyright rules, TLP:CLEAR information may be distributed without restriction. For more information on the Traffic Light
Protocol, see Traffic Light Protocol (TLP) Definitions and Usage.
Executive Summary
Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government,
critical infrastructure, and other organizations. The Gunra ransomware variant first
appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a
double-extortion model, both encrypting data and threatening to publish exfiltrated
data to a dedicated leak site (DLS) if the ransom is not paid. This advisory provides
technical details of the activity, as well as tailored detection and mitigation guidance
to protect at-risk organizations from Gunra.
Key Actions
Prioritize patching known exploited vulnerabilities in internet-facing systems,
including virtual private network (VPN) gateways and remote desktop protocol
(RDP)-exposed infrastructure.
Implement and test offline, immutable backups stored in a physically separate,
segmented location to ensure recoverability without ransom payment.
Segment networks to restrict lateral movement from an initially compromised
device to other systems in the organization.
Indicators of Compromise
For a downloadable copy of indicators of compromise, see:
AA26-222A STIX XML (55KB)
AA26-222A STIX JSON (62 KB)
Intended Audience Organizations: Government, Critical Infrastructure
Sectors: Healthcare and public health, financial services and insurance, critical
manufacturing and construction, transportation systems and logistics, government
services and facilities, utilities, academia, media and communications, retail, and
professional and nonprofit services.
Roles: Cybersecurity architects, defensive cybersecurity analysts, vulnerability
analysts, systems administrators, and security systems managers.
https://media.defense.gov/2026/Aug/...tical infrastructure, and other organizations.
