Gunra Ransomware — Victims, Campaigns & Activity

Related Threat Clusters

• Operation Double Barrel: State-Sponsored Exploitation of Korean Financial Software

  From 2025 to mid-2026, a state-sponsored threat group exploited vulnerabilities in Korean financial security software, utilizing watering hole attacks and spear phishing to deploy backdoors named Struggle and Brandoor.…

  7 articles · Updated July 30, 2026
• Ransomware Groups The Gentlemen and Gunra Intensify RaaS Operations in 2026

  The Gentlemen, a ransomware-as-a-service (RaaS) group, has emerged as a significant threat since its inception in mid-2025, with 332 reported victims in the first five months of 2026. They leverage Fortinet and Cisco…

  3 articles · Updated May 15, 2026
• Ransomware Fuels Surge in Global Cyberattacks

  As of February 12, 2026, organizations worldwide are experiencing an average of 2,090 cyber-attacks per week, largely driven by ransomware incidents. This increase highlights the ongoing challenges faced by businesses…

  1922 articles · Updated February 12, 2026

Recent Intelligence Reports

• Inside Gunra Raas From Affiliate Recruitment On The Dark Web To Full Technical Dissection Of Their Locker — www.cloudsek.com · August 12, 2026
• Police and FBI Issue 'Gunla' Ransomware Advisory... "Demands Ransom Holding Data Hostage" — www.yna.co.kr · August 12, 2026
• Breakglass Intelligence's March 2026 analysis — intel.breakglass.tech · August 12, 2026
• Korea, US issue joint advisory on 'Gunra' ransomware attacks — www.koreatimes.co.kr · August 12, 2026
• Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure — Infosecurity-Magazine · August 12, 2026
• Gunra Ransomware Uses ChaCha20 and RSA-4096 Encryption — Socprime · August 12, 2026
• Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA — Darkreading · August 11, 2026
• Six Agencies Warn Gunra Ransomware Hacked MFA at Server Level; Linux Victims May ... — Techtimes · August 11, 2026

Related Entities