CISA and partners warn of Gunra ransomware targeting critical infrastructure

CISA and several U.S. and South Korean partners have issued a joint cybersecurity advisory warning that Gunra ransomware actors are targeting critical infrastructure organizations worldwide.

The advisory says the group is using known vulnerabilities in internet-facing devices to gain access, then stealing data, encrypting systems and trying to extort victims. CISA said the warning covers sectors that support public services and private industry, including healthcare and public health, financial services, government services and facilities, and professional and nonprofit services.

According to CISA, the advisory is titled #StopRansomware: Gunra Ransomware. It was released with the FBI, the Defense Criminal Investigative Service, the National Security Agency, the U.S. Secret Service and the Republic of Korea’s National Policy Agency.

CISA said Gunra is a ransomware-as-a-service variant used by affiliates against organizations around the world. The advisory says the actors gain initial access by exploiting CVE-2024-55591 and CVE-2025-24472 in internet-facing devices.

The group uses a double-extortion model, according to the advisory. That means attackers steal data and encrypt systems, then pressure victims with the threat of publishing the stolen information if ransom is not paid within five to seven days. CISA said the actors negotiate through a Tor-based portal.

The advisory includes tailored detection guidance, indicators of compromise, recommended actions if compromise is suspected and mitigation steps aligned to Cross-Sector Cybersecurity Performance Goals, or CPGs. Those goals are a set of recommended security practices for reducing risk across sectors.

CISA Acting Executive Assistant Director for Cybersecurity Chris Butera said Gunra is another variant in an ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations. He urged organizations to mitigate the vulnerabilities identified in the advisory, implement the recommended actions and adopt security measures aligned with CPGs.

The advisory was published as a CISA RSS item dated Aug. 10, 2026, according to the source log provided with the brief.

Sources

• CISA news release: CISA, FBI and partners warn organizations about Gunra ransomware actors targeting multiple critical infrastructure sectors

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.