Skip to content
OriginalSign in

DataBreachesDissent

Gunra Ransomware Targets Government and Critical Infrastructure

Part of the Gunra story · since 31 Jul

Quiet for 13 weekslast report 12 Aug5 articles4 outlets
31 Jul · DataBreaches first23 Sep11 OctNowThis article2nd of 5
  • Fri 31 Jul, 13:09 UTC. DataBreaches, first report. Lazarus shares tools with Gunra ransomware in South Korea attacks.
  • Mon 10 Aug, 19:26 UTC. DataBreaches. Gunra Ransomware Targets Government and Critical Infrastructure. This article, 2nd of 5.
  • Tue 11 Aug, 11:20 UTC. The Hacker News, its first report on the story. Gunra Ransomware Exploits Fortinet, Schneider Weaknesses.
  • Tue 11 Aug, 22:01 UTC. Dark Reading, its first report on the story. Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:31 UTC. Infosecurity, its first report on the story. Gunra ransomware exploits Fortinet flaws, targets government.

Gunra is a ransomware-as-a-service (RaaS) targeting government and critical infrastructure, first emerging in 2025 and expanding operations in 2026. It employs a double-extortion strategy, encrypting data and threatening to publish stolen data if the ransom is not paid. The advisory offers technical specifics and guidance for organizations to protect against Gunra.

Key actions include prioritizing patches for known vulnerabilities, implementing offline immutable backups, and segmenting networks to limit lateral movements. Additionally, indicators of compromise are provided with downloadable resources.

How the story developed

All 5 articles
Quiet for 13 weekslast report 12 Aug5 articles4 outlets

5 articles from 4 outlets since 31 Jul. Quiet since 12 Aug. This was the 2nd report, 10 days after the first.

Now31 Jul23456789101112First reportDataBreaches · 31 Jul, 13:09This article2nd of 5 · day 10Exploited CVEDark Reading · 11 Aug
  • Fri 31 Jul, 13:09 UTC. DataBreaches, first report. Lazarus shares tools with Gunra ransomware in South Korea attacks.
  • Mon 10 Aug, 19:26 UTC. DataBreaches. Gunra Ransomware Targets Government and Critical Infrastructure. This article, 2nd of 5.
  • Tue 11 Aug, 11:20 UTC. The Hacker News, its first report on the story. Gunra Ransomware Exploits Fortinet, Schneider Weaknesses.
  • Tue 11 Aug, 22:01 UTC. Dark Reading, its first report on the story. Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:31 UTC. Infosecurity, its first report on the story. Gunra ransomware exploits Fortinet flaws, targets government.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Fri 31 JulDay 01
    1. Lazarus shares tools with Gunra ransomware in South Korea attacks13:09 · DataBreaches · First report

  2. Quiet for 10 days

    Mon 10 AugDay 101
    1. Gunra Ransomware Targets Government and Critical Infrastructure19:26 · DataBreaches · Picked up again · This article, 2nd of 5
  3. Tue 11 AugDay 112
    1. Gunra Ransomware Exploits Fortinet, Schneider Weaknesses11:20 · The Hacker News
    2. Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA22:01 · Dark Reading · Exploited CVE · Known exploited CVE
  4. Wed 12 AugDay 121
    1. Gunra ransomware exploits Fortinet flaws, targets government13:31 · Infosecurity

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in