aa26-222a-stopransomware-gunra-ransomware_508c.pdf (1 MB)

Gunra evolved from a Conti-derived ransomware variant first observed in April 2025 into a structured ransomware-as-a-service operation with Windows and Linux encryptors. Its affiliates exploit vulnerable or weakly secured VPN and firewall appliances, steal credentials and sessions, move laterally with RDP and Impacket, and exfiltrate cloud and local data before encrypting systems with ChaCha20 and RSA-4096. Observed intrusions included persistent MFA bypass, theft of enterprise passwords, deletion of logs and backups, and exfiltration volumes reaching tens of terabytes. CISA and its partners recommend urgent edge-device patching, network segmentation, strong account controls, and tested offline immutable backups.