# Gunra ransomware targets critical infrastructure with known exploits US cyber agencies warn critical infrastructure operators to patch vulnerabilities exploited by Gunra ransomware. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-08-11 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/b876609c-d385-4659-a0cd-7d11aa72d109 ## The rise of Gunra ransomware First emerging in 2025, Gunra ransomware quickly evolved into a global threat. US agencies including CISA, FBI, NSA, and Secret Service revealed Gunra now operates as ransomware-as-a-service (RaaS). Affiliates worldwide use the malware to target healthcare, financial services, government entities, and other critical infrastructure operators. The rapid expansion demonstrates the growing sophistication of cybercriminal operations. ## Exploited vulnerabilities Attackers leverage authentication bypass flaws CVE-2024-55591 and CVE-2025-24472 in Fortinet's FortiOS and FortiProxy products. These vulnerabilities allow administrative access through internet-facing devices. Security experts emphasize critical infrastructure operators must immediately patch these vulnerabilities. While Fortinet released security updates, many systems remain unprotected against these known exploits. ## Double extortion tactics Gunra operators employ standard double extortion methods after breaching systems: stealing data, encrypting files, then demanding ransom for decryption and non-disclosure of stolen information. Victims communicate through a Tor-based portal and typically receive 5-7 days before data publication. This approach has become the hallmark of modern ransomware attacks, combining financial pressure with reputational risk. ## New Linux variant emerges Initially detected by Trend Micro in April 2025 targeting Windows systems with elements borrowed from Conti ransomware, researchers later discovered a Linux variant. The Linux version can execute up to 100 parallel encryption threads and supports partial file encryption, allowing attackers to selectively encrypt portions of files. This expands the malware's potential impact across different operating environments. ## Global impact Gunra activity has been observed in Turkey, Taiwan, the US, and South Korea. The gang's leak site lists victims across Brazil, Japan, and Canada, including manufacturers, healthcare providers, IT companies, and law firms. The diverse targeting suggests opportunistic rather than selective attacks, with any vulnerable organization potentially at risk regardless of sector or location. ## Recommended defenses Security professionals urge immediate patching of known vulnerabilities in internet-facing systems. They emphasize securing VPN gateways and RDP access with multi-factor authentication as critical protection measures. Network segmentation and maintaining offline, immutable backups significantly complicate attackers' efforts even after initial access, reducing potential damage from ransomware incidents. ## Sector-specific consequences Ransomware attacks pose life-threatening risks to healthcare organizations while causing operational disruptions in financial services and government agencies. Beyond financial losses, these incidents damage reputations and erode public trust. For critical infrastructure operators, cybersecurity has become fundamental to business continuity rather than just an IT concern. ## Future risks CISA's Acting Executive Assistant Director for Cybersecurity Chris Butera identified Gunra as part of the ongoing ransomware trend harming US and international organizations. Security experts warn the proliferation of RaaS models will likely increase such attacks. Organizations must implement proactive security measures and develop comprehensive incident response plans to mitigate evolving cyber threats. ## Sources covering this story - https://www.theregister.com/cyber-crime/2026/08/11/feds-warn-gunra-ransomware-is-exploiting-known-bugs-to-hit-critical-infrastructure/5286263 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._