Cybersecurity Policy Report, Cyber Defense Agencies Warn About Gunra Ransomware, (Aug 11, 2026)
Organizations Mentioned:U.S. Secret Service
Warnings about a ransomware variant that has targeted critical infrastructure worldwide were issued yesterday by cyber defenders from the U.S. and South Korea.
“Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations,” according to the advisory.
“The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid,” it says.
Because Gunra operators access networks by exploiting known vulnerabilities, the advisory recommends that organizations keep their systems up to date and apply new patches promptly. The advisory also provides information on how to spot Gunra.
“Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations,” Chris Butera, acting executive assistant director–cybersecurity for the Cybersecurity and Infrastructure Security Agency, said in a news release. “To combat cyber threat activity, CISA continues to work with our government, industry and international partners to provide timely and actionable information that reduces the prevalence of damaging ransomware incidents.”
CISA was joined in issuing the advisory by the Federal Bureau of Investigation, Department of Defense Cyber Crime Center, National Security Agency, U.S. Secret Service, and South Korea’s National Police Agency.
News: FederalLegislation InternationalLegislation DataSecurity