Attribution: reported
Profile assembled from related reporting.
Known campaigns
—
Malware
—
Target industries
—
Target regions
—
The Gunra ransomware-as-a-service operation has been observed exploiting vulnerabilities in Fortinet firewall and VPN appliances to bypass multi-factor authentication and target critical infrastructure organizations. The attacks leverage leaked Conti ransomware code and known older flaws in Fortinet products, with reported successes against global critical infrastructure targets.
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and international partners have released joint advisory AA26-222A warning of Gunra ransomware, a ransomware-as-a-service (RaaS) variant that expanded operations in 2026. Gunra employs a double-extortion model, encrypting victim data and threatening publication on a dedicated leak site. Initial access is achieved through exploitation of known vulnerabilities in internet-facing VPN gateways and Remote Desktop Protocol (RDP) infrastructure. The advisory provides detection guidance, indicators of compromise, and mitigation recommendations for affected sectors.