Gunra Goes Franchise: Conti's Leaked Code Now Ships With a Builder and an Affiliate Panel

A joint #StopRansomware advisory on Gunra ransomware was published August 10, 2026.

The advisory was produced by CISA with the Department of Defense's Cyber Crime Center, FBI, National Security Agency, Secret Service and the Republic of Korea's National Police Agency.

The FBI first observed Gunra in April 2025 as a double-extortion ransomware variant derived from leaked Conti ransomware source code.

The advisory states the FBI observed the group adopting new branding aliases, notably operating under the name Golden Community, to support its expansion.

Gunra has commercialized its platform by recruiting penetration testers and ethical hackers to serve as initial access brokers, offering a share of ransom profits in exchange for enterprise network access.

CyberScoop reports Gunra is not alone among ransomware-as-a-service outfits recruiting penetration testers.

According to the advisory, Gunra actors primarily gained initial access by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN gateways.

The double-extortion group established a data leak site on Tor to list victims and publish stolen data.

Victims observed on the group's dedicated leak site include organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific.

Targeted sectors include healthcare and public health, financial services and insurance, critical manufacturing, transportation, government services, utilities, academia, media and communications, retail, and professional and nonprofit services.

Counting the authoring bodies listed (CISA, DoD Cyber Crime Center, FBI, NSA, Secret Service, ROK National Police Agency) gives six agencies.

The affiliate program provides affiliates with a management panel, a configurable ransomware builder, cross-platform locker payloads and affiliate documentation.

The interval between the FBI's first observation of Gunra (April 2025) and the launch of its formal RaaS affiliate program (January 2026) is about nine months.

Gunra initially focused on Windows environments before introducing a Linux variant and moving toward broader cross-platform targeting.

The FBI observed exploitation of CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities affecting specific FortiOS and FortiProxy versions.

The Republic of Korea's National Police Agency observed Gunra actors exploiting credential exposure and SSH access control weaknesses in internet-facing VPN gateways to obtain unauthorized remote access.

In one case, actors compromised an SSL-VPN appliance using default credentials where account lockout controls were absent, then used stolen session information to access internal virtual desktop infrastructure and move through systems including Active Directory servers and IT personnel workstations.

After gaining access, attackers used tools including Impacket utilities to move laterally through victim networks using SMB.

The FBI observed Gunra actors collecting business-critical documents, databases, personally identifiable information and internal email communications.

In at least one case, the actors used a malicious executable called main.exe to exfiltrate data from Microsoft OneDrive and SharePoint.

Compressed archives containing sensitive information were transferred to the Mega file-sharing service, with the volume of exfiltrated data reaching tens of terabytes.

For encryption, Gunra uses ChaCha20 and RSA-4096 algorithms and has been observed using the .ENCRT extension for encrypted files.

A documented Gunra sample from July 2025 used the .CRYPT extension.

The ransomware uses Windows Management Instrumentation to delete volume shadow copies before encryption.

One victim had backup and archived data deleted from both primary and disaster recovery infrastructure.

Chris Butera, acting assistant director for cybersecurity at CISA, said: "Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations."

Research published in July by South Korean cybersecurity firm AhnLab took note of Gunra overlap with Lazarus Group, although the report does not explicitly name Lazarus Group.

AhnLab wrote that although the state-sponsored threat group and the Gunra ransomware group appear to be separate threat actors with different ultimate objectives, they may have shared certain techniques, tools and infrastructure or collaborated to a limited extent during the attacks.

The authoring agencies recommend prioritizing patching of known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure.

The agencies advise implementing and testing offline, immutable backups stored in physically separate and segmented locations.

Network segmentation is another key recommendation, intended to restrict lateral movement and limit the spread of ransomware between systems.

The agencies also recommend reviewing domain controllers, servers, workstations and Active Directory environments for unrecognized accounts, auditing administrative privileges, requiring MFA where possible and testing security controls against the Gunra techniques mapped to the MITRE ATT&CK framework.

CyberScoop reported that the U.S. and South Korean agencies warned Gunra benefits from North Korean government-linked hackers' tools to target government and critical infrastructure organizations.

CyberScoop states that North Korean government collaboration with ransomware gangs dates back to at least 2024.