US, South Korea Warn of Growing Gunra Ransomware Threat

Gunra is a rapidly evolving ransomware operation that appeared in South Korea in April 2025 and has grown into an international ransomware-as-a-service campaign affecting at least 32 organizations by March 2026; it uses leaked Conti code initially, later developed its own cross-platform (Windows and Linux) ransomware, employs double-extortion data theft, and leverages affiliates to scale attacks against government and critical infrastructure. The advisory emphasizes familiar defenses — patching, reducing internet-facing exposure, strong authentication, network segmentation, monitoring for lateral movement and data exfiltration, and isolated backups — to reduce impact.