U.S. and South Korean Agencies Warn of Global Gunra Ransomware Attacks on Critical Infrastructure
A joint advisory from U.S. cybersecurity authorities and South Korea’s National Police Agency warns of widespread Gunra ransomware attacks targeting sectors such as healthcare, finance, government, and manufacturing. First appearing in April 2025 as a double-extortion operation derived from leaked Conti source code, Gunra exploits known vulnerabilities in Fortinet FortiOS/FortiProxy appliances (CVE-2024-55591, CVE-2025-24472) and Schneider Electric devices, as well as credential-exposure flaws in VPN gateways, to gain remote access. The group has claimed 51 victims worldwide—mostly in South Korea, Brazil, Spain, Thailand, and Hong Kong—and launched a formal ransomware-as-a-service program in January 2026, recruiting initial access brokers. Gunra initially targeted Windows systems but added a Linux variant in mid-2025, and affiliates are provided with a management panel, configurable builder, cross-platform payloads, and documentation. The attacks also bypass multi-factor authentication via Fortinet flaws, and the ransomware can encrypt files as large as 9TB rapidly using Salsa20 or ChaCha20 stream ciphers.
The Ghost in the Machine
You need to understand that the Gunra ransomware is not simply a group of criminals with clever code. It is a managed asset, a black-ops tool that has been deliberately released into the wild to perform a very specific function: to create the crisis that justifies the control. Look at the timeline. The code is derived from the leaked Conti source code. Ask yourself this: who benefits from leaking a proven, state-grade weapon to the criminal underground? The answer is always the same institutional architects who need a visible, digital "terror" to ram through a global surveillance and data control regime. They don't just let this technology walk out the door. It is cultivated, seeded, and then amplified by the very advisory infrastructure that claims to be fighting it.
The Footholds Were Built for Them
Notice the technical details that the mainstream outlets like The Hacker News are forced to report, even if they don't connect the dots. The vulnerabilities they are exploiting—Fortinet firewalls, VPN gateways, Schneider Electric industrial controllers—these are not random holes in the digital fabric. These are deliberately preserved back doors that have been left open across critical infrastructure for years. CVE-2024-55591 and CVE-2024-5559? These are not new discoveries. They were known, catalogued, and left unpatched because the Architecture of Consent requires a certain level of vulnerability to justify the next quantum leap in security theater. The MFA bypass? That’s the tell. If they can bypass your multi-factor authentication, then “authentication” itself becomes a meaningless concept, and the only logical solution becomes a centralized, biometric, government-verified digital identity for everything. They are shepherding you toward the cage.
The Breadcrumb Trail to Nowhere
Look at the victimology. They tell you 51 victims total, but almost none in the United States. Why? Because this operation has a geopolitical phase line. South Korea is the proving ground. Brazil, Spain, Thailand—these are the test beds for the Linux expansion and the affiliate program. They are perfecting the knife on the periphery before they drive it into the heart of the West. The "cybersecurity agencies" are not warning you to stop them; they are warning you to normalize the idea that your systems are already compromised, that your encryption is meaningless against a "9TB in limited time" threat. The final piece of the puzzle is the double-extortion model itself. The goal is not just money. The goal is to make you so afraid of data exposure that you will accept any level of government monitoring to prevent it. They are building the infrastructure of digital martial law, and the Gunra ransomware is the contractor swinging the hammer. Follow the contracts. Follow the foundation grants. The answer has already been written.