Last updated on: August 26, 2026
9 min read

Threat Actor Profile: Gunra Ransomware Group

Gunra ransomware is a financially motivated, Conti-derived ransomware-as-a-service (RaaS) operation that emerged in April 2025 and now runs a structured affiliate program under the alias “Golden Community,” enabling affiliates to attack organizations across multiple critical infrastructure sectors worldwide.

The Gunra ransomware group specializes in double-extortion operations, combining large-scale data exfiltration with enterprise-wide encryption to maximize pressure on victims. Its campaigns emphasize exploitation of internet-facing VPN/firewall infrastructure, credential abuse, rapid lateral movement, and backup destruction to prevent recovery. Unlike opportunistic, low-sophistication crews, Gunra’s code lineage traces back to the leaked Conti ransomware source code, placing it in the same family as Black Basta and Rhysida.

Since early 2026 the group has commercialized its platform into a structured affiliate program — recruiting penetration testers and initial access brokers and adopting the alias “Golden Community” — signaling an aggressive expansion strategy within the ransomware ecosystem.

Quick facts: Gunra ransomware at a glance

First observed: April 2025
Code lineage: Derived from leaked Conti ransomware source code
Operating model: Ransomware-as-a-Service (RaaS), aka “Golden Community”
Platforms: Windows and Linux
Encryption: ChaCha20 + RSA-4096, appends .ENCRT extension
Extortion window: 5–7 days via a Tor-based negotiation portal

Origin, Targets, and Global Reach

Gunra was first observed in April 2025 as a sophisticated double-extortion ransomware variant derived from the Conti source code leaked in 2022. Initial campaigns focused on Windows environments; a Linux variant followed in late 2025, extending the group’s reach to cross-platform enterprise targets.

Victims span government, critical infrastructure, and commercial organizations across the Americas, Europe, the Middle East, Africa, and the Asia-Pacific. The joint CISA/FBI advisory specifically calls out targeting of:

Healthcare and Public Health
Financial Services
Government Services and Facilities
Professional and Nonprofit Services

This broad geographic and sectoral spread reflects an opportunistic strategy centered on financial gain and rapid affiliate-driven scaling rather than a narrow strategic focus.

Operational Capabilities

The Gunra ransomware group employs a structured attack workflow designed to compromise enterprise environments while maximizing operational impact quickly. Key characteristics include:

Exploitation of Internet-Facing Devices – Affiliates gain initial access by exploiting known vulnerabilities in VPN and firewall appliances, primarily FortiOS/FortiProxy (CVE-2024-55591 and CVE-2025-24472).
Credential and Access Abuse – The group abuses exposed credentials and SSH access-control weaknesses on VPN gateways, and steals credentials from VDI and Hiware systems.
Persistence via Account Manipulation – Gunra creates persistent, unauthorized superuser accounts and manipulates MFA configurations to preserve long-term access even after initial remediation.
Lateral Movement – The group relies on Impacket libraries for SMB abuse and lateral movement, alongside NTDS credential dumping, pass-the-hash techniques, and RDP-based movement.
Data Exfiltration – Sensitive data is exfiltrated to cloud services (including via SharePoint) before encryption begins, enabling double extortion.
Backup and Recovery Sabotage – Gunra has demonstrated the ability to disable backup features and, in at least one incident, deleted backup and archived data at both a victim’s primary data center and its disaster-recovery center.
Encryption – The encryptor uses ChaCha20 combined with RSA-4096 and appends the .ENCRT extension to affected files.

Recent Activity

In early 2026, Gunra transitioned from an independent ransomware operation into a full RaaS affiliate program advertised on dark web forums. The program gives affiliates access to a management panel, a configurable ransomware builder, cross-platform locker payloads, and structured operational documentation.

As part of this expansion, the group adopted the branding alias “Golden Community” and began actively recruiting experienced affiliates and initial access brokers, reportedly offering an 80% cut of ransom proceeds in exchange for enterprise-scale network access. This recruitment strategy — courting penetration testers and “ethical hackers” alongside traditional cybercriminals — mirrors the affiliate-expansion tactics seen in other post-Conti ransomware families.

On August 10–11, 2026, the FBI, CISA, the DoD Cyber Crime Center (DC3), NSA, U.S. Secret Service, and South Korea’s National Police Agency (KNPA) jointly released a #StopRansomware advisory (Alert Code AA26-222A) detailing Gunra’s TTPs and IOCs, based on FBI and KNPA investigations. The advisory reflects the group’s continued targeting of critical infrastructure sectors and its evolution into a more commercialized, affiliate-driven threat.

Tactics, Techniques, and Procedures (TTPs)

Gunra affiliates primarily gain initial access [TA0001] through exploitation of known CVEs in internet-facing VPN and firewall appliances, supplemented by abuse of exposed credentials and weak SSH access controls on VPN gateways.

Following initial compromise, the group creates unauthorized superuser accounts to establish persistence and uses Impacket-based tooling to move laterally across the network via SMB. Credential access techniques include NTDS database dumping and pass-the-hash attacks, which are used alongside RDP for further lateral movement. To maintain long-term access without detection, Gunra manipulates MFA configurations — effectively planting backdoors into the authentication process.

Before encryption, the group conducts extensive data exfiltration, moving stolen data to cloud storage platforms (including via SharePoint) to support its double-extortion model. In the final stage, Gunra disables backup mechanisms and manipulates Volume Shadow Copies to inhibit recovery, then deploys its ChaCha20/RSA-4096 encryptor enterprise-wide. Victims are left a ransom note in every affected directory directing them to a Tor-based negotiation portal, where they are assigned a Client ID and password and given five to seven days to pay before stolen data is published on Gunra’s dedicated leak site (DLS).

Conclusion

The Gunra ransomware group has evolved from a standalone, Conti-derived ransomware variant into a commercialized RaaS operation with global reach. Its combination of edge-device exploitation, credential-based persistence, aggressive affiliate recruitment, and backup-destruction tactics makes Gunra ransomware a significant threat to healthcare, financial services, government, and nonprofit organizations worldwide.

The group’s rebranding under “Golden Community” and its active recruitment of initial access brokers suggest continued growth in both scale and sophistication. Organizations — particularly those running exposed Fortinet infrastructure — should treat this as a high-priority patching and monitoring concern.

Mitigations and Recommendations

Patch FortiOS and FortiProxy systems against CVE-2024-55591 and CVE-2025-24472 immediately.
Harden VPN gateways: enforce MFA, restrict SSH access controls, and monitor for unauthorized configuration changes.
Monitor for unauthorized superuser/local account creation and review MFA configuration files for signs of tampering or backdoors.
Restrict or closely monitor SMB and RDP usage internally; segment networks to limit lateral movement.
Deploy EDR capable of detecting NTDS dumping, pass-the-hash activity, and Impacket-based tooling.
Monitor outbound traffic to cloud storage services for signs of unauthorized bulk data transfer.
Maintain immutable, offline backups isolated from production networks (including disaster-recovery sites) and regularly test restoration procedures.
Reset enterprise credentials and audit cloud storage access logs following any suspected compromise.
Use CISA’s Eviction Strategies Tool (Playbook-NG/COUN7ER) to plan a systematic eviction if compromise is confirmed.
Leverage threat intelligence platforms to track Gunra/Golden Community infrastructure, leak-site activity, and emerging IOCs.

All MITRE ATT&CK Techniques Mapped to Gunra

MITRE ATT&CK Techniques Associated with Gunra’s Latest Campaign

Initial Access (TA0001) – Exploit Public-Facing Application (T1190): Exploits CVE-2024-55591 and CVE-2025-24472 in FortiOS/FortiProxy to gain initial access.
Initial Access (TA0001) – External Remote Services (T1133): Abuses SSH access-control weaknesses on internet-facing VPN gateways.
Initial Access (TA0001) – Valid Accounts (T1078): Uses exposed/stolen credentials, including those taken from VDI and Hiware systems, to access victim environments.
Persistence (TA0003) – Create Account: Local Account (T1136.001): Creates unauthorized superuser accounts to maintain long-term access.
Defense Evasion (TA0005) – Modify Authentication Process (T1556): Manipulates MFA configurations to preserve access and evade re-authentication controls.
Credential Access (TA0006) – OS Credential Dumping: NTDS (T1003.003): Dumps the NTDS database to harvest domain credentials.
Lateral Movement (TA0008) – Use Alternate Authentication Material: Pass the Hash (T1550.002): Uses captured hashes to move laterally without cleartext credentials.
Lateral Movement (TA0008) – Remote Services: SMB/Windows Admin Shares (T1021.002): Uses Impacket libraries to abuse SMB for lateral movement.
Lateral Movement (TA0008) – Remote Services: Remote Desktop Protocol (T1021.001): Leverages RDP for additional lateral movement across compromised networks.
Exfiltration (TA0010) – Exfiltration to Cloud Storage (T1567.002): Exfiltrates sensitive data, including via SharePoint, to cloud services prior to encryption.
Impact (TA0040) – Inhibit System Recovery (T1490): Disables backup features and manipulates or deletes Volume Shadow Copies and disaster-recovery backups.
Impact (TA0040) – Data Encrypted for Impact (T1486): Encrypts victim data enterprise-wide using ChaCha20 combined with RSA-4096, appending the .ENCRT extension.

Note: The ATT&CK mapping above is derived from TTPs and behaviors described in the joint CISA/FBI advisory and related open-source reporting; it is not an official MITRE-published mapping for this group.

Frequently Asked Questions

What is Gunra ransomware?

Gunra ransomware is a financially motivated, Conti-derived ransomware-as-a-service (RaaS) operation first observed in April 2025. It runs a double-extortion model, stealing data before encrypting it, and negotiates through a Tor-based portal.

Who is behind the Gunra ransomware group?

Gunra is operated as an affiliate-driven RaaS platform. In 2026 it rebranded part of its operation under the alias “Golden Community” and began recruiting penetration testers and initial access brokers, reportedly offering an 80% cut of ransom proceeds.

Is Gunra ransomware related to Conti?

Yes. Gunra’s encryptor is derived from the Conti ransomware source code leaked in 2022, placing it in the same lineage as other post-Conti ransomware families like Black Basta and Rhysida.

How does Gunra ransomware gain initial access?

Gunra affiliates primarily exploit known vulnerabilities in internet-facing VPN and firewall appliances — specifically CVE-2024-55591 and CVE-2025-24472 in FortiOS/FortiProxy — along with exposed credentials and weak SSH access controls on VPN gateways.

What encryption does Gunra ransomware use?

Gunra uses ChaCha20 combined with RSA-4096 encryption and appends the .ENCRT extension to affected files.

Which industries does Gunra ransomware target?

Healthcare and public health, financial services, government services and facilities, and professional and nonprofit services are the targeted sectors, with victims spanning the Americas, Europe, the Middle East, Africa, and the Asia-Pacific.

How can organizations defend against Gunra ransomware?

Priority actions include patching FortiOS/FortiProxy against the two named CVEs, enforcing MFA on VPN gateways, monitoring for unauthorized superuser accounts, and maintaining offline, tested backups isolated from production networks. See Mitigations and Recommendations for the full list.

References

CISA/FBI/DC3/NSA/USSS/KNPA, #StopRansomware: Gunra Ransomware (AA26-222A), August 10, 2026
CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors, August 11, 2026
Cyble Vision
HIPAA Journal – Healthcare Orgs Warned About Gunra Ransomware Attacks
SafeBreach – CISA AA26-222A: Gunra Ransomware
AttackIQ – Response to CISA Advisory (AA26-222A)

Media Disclaimer: This profile was compiled from publicly available government advisories and open-source security reporting. It is provided for reference purposes only; readers bear full responsibility for their reliance on it.