CISA issued an advisory on Gunra, a ransomware variant that emerged in 2025 and became a ransomware-as-a-service operation in 2026, with affiliates targeting government bodies, critical infrastructure entities and other organizations. The advisory describes attackers encrypting data and threatening to release stolen information unless a ransom is paid, and provides technical details alongside detection and mitigation guidance.
OriginalquelleJournal · Cybersecurity and Infrastructure Security Agency
#StopRansomware: Gunra Ransomware
<h2><strong>Advisory at a Glance</strong></h2> <table> <tbody> <tr> <th>Title</th> <td>#StopRansomware: Gunra Ransomware</td> </tr> <tr> <th>Original Publication</th> <td>August 10, 2026</td> </tr> <tr> <th>Executive Summary</th> <td>Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid. This advisory provides technical details of the activity, as well as tailored detection and mitigation guidance to protect at-risk organizations from Gunra.</td> </tr> <tr> <th>Key Actions</th> <td> <ul type="square"> <li><strong>Prioritize patching known exploited vulne