Back Asec.Ahnlab

[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)

Asec.Ahnlab •ATCP • July 29, 2026

This technical analysis report was prepared as part of the joint cybersecurity advisory titled “Advisory on Cyberattacks Targeting Korean Citizens and Businesses by State- Hacking Groups” issued by the Republic of Korea’s National Intelligence Service (NIS), National Police Agency (NPA), Korea Internet & Security Agency (KISA), and Financial Security Institute (FSI). OverView AhnLab SEcurity […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation Double Barrel: State-Sponsored Exploitation of Korean Financial Software From 2025 to mid-2026, a state-sponsored threat group exploited vulnerabilities in Korean financial security software, utilizing watering hole attacks and spear phishing to deploy backdoors named Struggle and Brandoor. AhnLab identified that attacks deploying Gunra ransomware shared initial access vulnerabilities and malware characteristics with this state actor, indicating possible collaboration or shared resources. Several compromised watering-hole sites were linked to a Korean web-development company, suggesting a supply-chain compromise. The advisory was issued by multiple South Korean agencies to alert citizens and businesses about these threats. The ongoing investigations are focused on understanding the full scope and implications of these attacks. 7 sources 76

Extracted Entities

[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

Ransomware Groups (1)