FBI, CISA, and South Korea Warn a Conti-Derived Ransomware Gang Is Eating VPN Gateways for Breakfast
The FBI and South Korea's police force are warning that a ransomware operation built on leaked Conti source code has quietly become one of the busiest extortion crews in the business. In a joint advisory released Monday, the agencies detailed how the group behind "Gunra" ransomware breaks into government agencies, hospitals, banks, and manufacturers, and what defenders can actually do about it.
The advisory, published by CISA as AA26-222A, comes with a warning about how the group gets in. Gunra operators are exploiting public-facing flaws in Fortinet VPN gear, including two authentication-bypass bugs, CVE-2024-55591 and CVE-2025-24472, that CISA had already added to its catalog of known exploited vulnerabilities. The agencies also documented SSH access-control failures and, in one case, default credentials on an SSL-VPN appliance that had no lockout controls at all.
"Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations," said Chris Butera, acting executive assistant director for cybersecurity at CISA, in a statement picked up by The Record.
From Conti's Ashes to a Full RaaS Operation
Gunra first showed up in April 2025, built largely from the Conti ransomware source code that leaked in 2022 after the gang's own internal chats spilled online. FBI analysis says the code lineage shows up in how the encryptor works, from its use of native Windows APIs to its handling of volume shadow copies.
By January 2026, the group had formalized. It launched a ransomware-as-a-service affiliate program on dark web forums, complete with a management panel, a configurable builder, cross-platform lockers, and structured documentation for recruits. The FBI says the crew now operates under the alias Golden Community and has started recruiting penetration testers and "ethical hackers" as initial access brokers, offering a cut of the ransom in exchange for enterprise network access.
The rise reflects real money. Dragos counted 1,140 ransomware incidents against industrial organizations worldwide in the second quarter of 2026, up 12 percent from the first quarter, and it attributed at least four of those attacks to Gunra after the gang handled eight in Q1. Victims on the group's leak site span healthcare, financial services, critical manufacturing, transportation, utilities, academia, media, and retail, across the Americas, Europe, the Middle East, Africa, and Asia-Pacific.
The Breach Playbook: VPNs, VDI, and a Backdoor That Kills MFA
The advisory lays out a grimly detailed playbook from incidents the FBI and South Korea's National Police Agency investigated. It reads like a checklist of every remote-access weakness a security team can have.
Initial access usually comes through internet-facing devices. Beyond the Fortinet bugs, KNPA observed actors abusing SSH access-control weaknesses in VPN gateways. In the most telling case, the operators grabbed an administrator account on an SSL-VPN appliance by trying default credentials, because account lockout simply wasn't enabled. They then downloaded OpenSSH from an attacker-controlled server and built persistent tunnels into the victim network.
From there, the movement gets surgical. Using stolen session information, the actors entered a corporate virtual desktop infrastructure, moved laterally over RDP, and pivoted into the VDI authentication web server, the internal Active Directory server, and virtual desktops assigned to IT staff. On the way they used Impacket's secretsdump.py against domain controllers to pull password hashes from NTDS, enabling pass-the-hash and pass-the-ticket moves.
The nastiest detail: for one victim, Gunra actors rewrote authentication processing files on the VDI portal so that a specific attacker-chosen one-time password always worked. That gave them a persistent path around multi-factor authentication, the very control most organizations lean on hardest. They also stole a symmetric encryption key from a Hiware access-control server, which let them decrypt stored passwords for every enterprise server in the environment.
Encryption, Extortion, and a Five-to-Seven-Day Clock
The encryptor itself is fast and selective. Gunra's Windows binary walks every accessible volume, skips system directories and executable files, and hits user data with ChaCha20 plus RSA-4096 in a multi-threaded design that encrypts many files at once. Encrypted files get a .ENCRT extension, and each directory ends up with a ransom note named R3ADM3.txt.
Before encryption, the gang exfiltrates. The FBI documented a malicious executable, main.exe, pulling data from OneDrive and SharePoint, and at least one victim whose compressed archives, up to tens of terabytes, went to the file-sharing service Mega. Victims get a Client ID and password for a Tor-based negotiation portal, plus contact instructions over qTox, and are told to pay within five to seven days or watch their data go up on the leak site. Ransom demands routinely start above ten million dollars, the advisory says.
Pressure tactics go beyond encryption. The actors deleted volume shadow copies with WMI commands, and in one case wiped backup and archive data at both the primary data center and the disaster recovery center before and after deployment. The FBI also observed attempts to email victim management directly to press for payment, with limited success. If victims hold out, the gang lists them on its Tor leak site and offers directory previews of the stolen OneDrive and SharePoint files to prove the data is real.
A Fatal Flaw in the Linux Version
There is one bright spot for defenders. In March 2026, researchers at Breakglass Intelligence found that Gunra's Linux encryptor has a weak pseudorandom number generator, seeded with the predictable srand(time(NULL)). Because the seed is tied to the system clock, the encryption keys can be reconstructed from file timestamps, which means Linux victims can recover their files without paying.
CISA and its partners flagged that finding in Monday's advisory as part of the incident response guidance. The agencies also repeat the standard but still necessary advice: patch internet-facing VPN gateways and RDP-exposed gear first, keep offline immutable backups in a physically separate segment, require MFA everywhere it can be enforced, audit privileged accounts, and segment networks so an initial foothold doesn't become a full domain takeover.
What Security Teams Should Actually Do
The advisory doubles as a detection checklist. Teams should review logs on network appliances for anomalous activity tied to privileged users, look for newly created archives before encryption starts, and hunt for the tooling Gunra actors drag in: 7-Zip, RClone, FileZilla, Impacket scripts, and OpenSSH tunnels where they weren't before. Gunra actors do most of their work between 10 p.m. and 6 a.m. local time, and they clear command history and system logs to cover their tracks, so log forwarding to a hardened SIEM matters more than usual.
CISA's Eviction Strategies Tool, which pairs the Playbook-NG web application with the COUN7ER countermeasure database, is referenced as a free starting point for building a systematic eviction plan once an intrusion is confirmed.
The agencies are explicit that paying the ransom is a bad bet. Payments don't guarantee files come back, fund further attacks, and mark the victim as a repeat target. Instead, they want incident reports filed with the FBI's IC3, a local field office, the Secret Service, or CISA directly, and, for organizations in South Korea, with KNPA through its online cybercrime reporting system.
Gunra is the second Conti lineage product to draw a joint advisory this year, after the operators behind it kept the source code alive well past the original gang's collapse. For defenders, the message from Monday's report is blunt: the code is old, the tactics are known, the entry points are patched vulnerabilities, and the difference between a scare and a catastrophe usually comes down to whether the VPN gear was updated last quarter.
Read more coverage of the threats hitting cybersecurity teams, including the Fortinet and FortiProxy flaws that kicked off the 2026 patch cycle, and how edge appliances keep becoming ransomware doors.