Six agencies issued joint guidance on a ransomware group breaking into networks through security holes in firewall equipment that manufacturers fixed more than a year ago.

 

What happened

The FBI, the Cybersecurity and Infrastructure Security Agency, the Department of Defense Cyber Crime Center, the National Security Agency, the US Secret Service, and the Republic of Korea's National Police Agency published a joint advisory on August 10, 2026, covering Gunra, a ransomware operation active against healthcare and public health organizations among other sectors, CISA announced. Designated AA26-222A, the document forms part of the agency's #StopRansomware series. Gunra affiliates get in by exploiting two known security flaws, catalogued under the reference numbers CVE-2024-55591 and CVE-2025-24472, in FortiOS and FortiProxy, the operating system and web filtering software running on Fortinet firewall appliances. Both flaws let an attacker skip the login process entirely and take administrator-level control of any such device reachable from the internet, as The Register reported. Korean investigators separately found the group taking advantage of exposed login credentials and weak access controls on virtual private network (VPN) gateways, the devices that let staff connect to an internal network from outside the building. The specific weakness involved Secure Shell (SSH), the tool administrators use to log into and operate a server remotely.

 

Going deeper

Gunra runs a double extortion model, stealing data before encrypting systems so that refusing payment still carries the threat of publication. Victims negotiate through a website reachable only through Tor, software that routes traffic across multiple relays so the server's real location stays hidden, and are typically given five to seven days before stolen files go to a public leak site, according to the advisory. The underlying code descends from Conti, a major ransomware operation whose internal files and source code were published online in February 2022 following a dispute among its members. Inheriting working code explains how a group first observed in April 2025 arrived with capable tooling rather than building its own. Once inside a network, affiliates use Impacket, a freely available toolkit for interacting with Windows network protocols, to move between systems over Server Message Block (SMB), the protocol Windows computers use to share files and printers with one another. They then delete system and network access logs and clear command histories to complicate any later investigation. The operation added a Linux payload after starting with Windows, extending its reach to server environments common in clinical and imaging infrastructure.

 

What was said

"Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to US and international organizations," said Chris Butera, CISA's acting executive assistant director for cybersecurity, in remarks reported by The Record on August 10, 2026. He said the agencies are circulating the advisory to government organizations and industry groups to disrupt the group's continued operations.

 

In the know

One finding in the advisory changes the calculation for any organization hit by the Linux version. Researchers identified a weakness in those builds as of March 2026 that lets defenders reconstruct the encryption keys using file timestamps and recover files without paying, The Record reported. Organizations facing a Gunra demand should therefore establish which variant encrypted their systems before any payment discussion begins. The group applies pressure outside the negotiation portal as well, with the FBI observing affiliates emailing management staff at victim companies directly to solicit payment, according to BleepingComputer, an approach the bureau noted has met with limited success.

 

The big picture

Both firewall vulnerabilities carry 2024 and 2025 identifiers, so the entry point in these attacks is a patch that has been available for well over a year. The American Hospital Association flagged the advisory to its members alongside its detection and mitigation guidance, which centers on patching known exploited vulnerabilities in internet-facing systems, requiring multifactor authentication on VPN and remote desktop access, and dividing networks into separate zones so that an attacker who compromises one device cannot reach everything else. Backups deserve separate thought under a double extortion model, since offline and immutable copies restore operations without addressing data already taken. A healthcare organization that recovers cleanly from encryption still faces the breach determination, the notification timeline, and whatever the group chooses to publish.

 

FAQs

What does it mean that Gunra came from leaked Conti source code?

Conti operated as one of the most prolific ransomware groups until its internal files and source code were published in February 2022 following a dispute among its members. That release handed working ransomware to anyone who wanted it, and several operations since have been built on the code, which is why newer groups sometimes appear with capabilities that would ordinarily take years to develop.

 

Why do attackers delete logs, and what can be done about it?

Removing event logs and command histories deprives investigators of the record needed to determine what was accessed, which complicates the risk assessment a covered entity must complete. Forwarding logs to a separate system that the compromised network cannot reach preserves that evidence, since attackers can only delete what remains under their control.

 

Does recovering files without paying end the incident?

No. Recovery addresses availability, while the data taken before encryption remains in the attacker's possession. The organization still assesses whether protected health information was acquired without authorization, and notification obligations run from that determination regardless of whether systems came back online.

 

What is an initial access broker?

A criminal who compromises networks and sells that access to others rather than carrying out attacks. The advisory describes Gunra recruiting for this role directly, which shortens the path between an unpatched appliance and a ransomware deployment, since the group buys entry rather than finding it.

 

How should an organization verify its exposure to these specific flaws?

Inventory every internet-facing firewall and VPN appliance, confirm firmware versions against the vendor's advisories for both identifiers, and check whether administrative interfaces are reachable from the internet at all. Appliances that cannot be patched promptly should have management access restricted to internal networks while remediation is scheduled.