FBI, South Korea warn of Gunra ransomware gang targeting critical infrastructure

U.S. and South Korean agencies warned that the Gunra ransomware group — built from leaked Conti code and now operating as a Ransomware-as-a-Service — is actively exploiting Fortinet firewall vulnerabilities (CVE-2024-55591 and CVE-2025-24472) to breach healthcare, financial, government and industrial organizations, steal and encrypt data, and issue multimillion-dollar ransom demands; the advisory also notes tool-sharing links to Lazarus and that a weakness in Gunra's Linux variant can allow defenders to recover files without paying.