Gunra Ransomware Campaign

Gunra is both a ransomware family and the service operated around it. It began in April 2025 with code derived from or influenced by leaked Conti source code, then expanded into a formal RaaS program in January 2026. Affiliates receive a management panel, configurable builder, cross-platform lockers, and operating documentation; the operator has also used the alias Golden Community.^{1, 2, 3}

The strongest observed entry paths are exploitation of CVE-2024-55591 and CVE-2025-24472 in FortiOS/FortiProxy, credential exposure, weak SSH controls, default VPN credentials, and absent account lockout. Post-access activity includes malicious account creation, credential and session theft, VDI/RDP movement, MFA bypass, domain-controller dumping, cloud-data exfiltration, and destructive encryption.¹

Conti-derived code does not prove that former Conti personnel operate Gunra. The Gunra label also does not identify a particular affiliate. This brief attributes the documented activity to Gunra actors as the joint advisory does, while leaving human identity, geography, and state sponsorship unassigned.^{1, 2}

Gunra is a financially motivated double-extortion ransomware ecosystem. The malware appeared in April 2025 and draws from leaked Conti source code. In January 2026, the operation formalized a RaaS affiliate program that offers a management panel, configurable builders, Windows and Linux lockers, and documentation to criminal affiliates. The operator has used the Golden Community alias and recruited penetration testers or access brokers for enterprise access.^{1, 2, 3}

The new joint government advisory turns Gunra from a largely malware- and leak-site-centered story into a documented intrusion campaign. FBI observations include exploitation of FortiOS/FortiProxy authentication-bypass vulnerabilities CVE-2024-55591 and CVE-2025-24472. KNPA observations add credential exposure, weak SSH controls, default SSL-VPN credentials, missing lockout, and malicious modification of remote-access accounts.¹

After entry, Gunra actors have created the forticloud-sync superuser, used Impacket over SMB, dumped NTDS hashes, reused hashes and Kerberos tickets, stolen VDI sessions, sniffed authentication traffic, and modified a VDI portal so an attacker-selected OTP bypassed MFA. This makes identity, session, authentication-code, and administrative-change review as important as malware scanning.¹

The operation collects business documents, databases, PII, internal email, and system/network configuration data. FBI reporting describes main.exe targeting OneDrive and SharePoint and archives exfiltrated to Mega, in one case reaching tens of terabytes. Common dual-use utilities include 7-Zip, WinRAR, RClone, FileZilla, AnyDesk, Google Remote Desktop, Mimikatz, Impacket, Sliver, and OpenSSH; their presence requires context, not automatic malicious attribution.¹

Gunra encrypts accessible data with ChaCha20 and RSA-4096 and supports Windows and Linux environments. Common artifacts include .ENCRT and .CRYPT extensions and the ransom note R3ADM3.txt. Actors have deleted volume shadow copies and destroyed backup/archive data in both primary and disaster-recovery environments, so recovery assurance must be independent of the production identity plane.^{1, 2}

For U.S. SMBs and MSP-managed customers, the most important lesson is blast radius. An exposed firewall, VPN, administrator workstation, VDI portal, domain controller, Microsoft 365 tenant, NAS, or backup platform can become a bridge to many systems and customers. An insurer or executive should ask for proof of fixed versions, historical exposure review, identity and session containment, data-access scoping, and tested clean recovery—not a patch receipt alone.¹

IntelliOS previously maintained a Gunra actor card sourced from public ransomware and malware research. No PANDA Gunra brief or dedicated Gunra campaign card was published. This release creates both, updates the actor evidence with the new advisory, and keeps actor, malware, affiliate, campaign, IOC, and victim claims separated. It is a material delta rather than recycled coverage.^{1, 2, 3}