CISA warns Gunra ransomware shifts to affiliate RaaS model
Gunra's move from lone variant to structured affiliate operation mirrors the Conti playbook (whose leaked source code it's built on) widening the attack surface for state and local government.
TL;DR
CISA and the FBI released joint detection and mitigation guidance Monday for Gunra ransomware, which expanded from a single 2025 variant into a structured ransomware-as-a-service operation in early 2026. The advisory flags affiliate-driven double-extortion campaigns targeting government, healthcare, utilities, and other critical infrastructure sectors. Gunra actors gain initial access primarily through known vulnerabilities in internet-facing VPN gateways and firewall appliances (including CVE-2024-55591 and CVE-2025-24472) then exfiltrate data before encryption and threaten publication on a Tor-based leak site. The technical lineage traces directly to the Conti source code leaked in 2022.
The advisory, published August 10, 2026 as AA26-222A, confirms what threat researchers had been tracking since mid-2025: Gunra isn't a one-off variant anymore. The group launched a formal RaaS affiliate program on dark web forums in January 2026, offering recruits a management panel, a configurable builder, cross-platform payloads, and structured documentation. The FBI says the group has also been recruiting penetration testers as initial access brokers, paying them a share of ransom profits for enterprise network access.
The Conti inheritance and what it means for defenders
Gunra's technical foundation (Conti's leaked source code) makes it a known quantity in one sense and a harder problem in another. Defenders who hardened environments against Conti and its post-leak descendants aren't starting from zero. But the RaaS model means affiliates bring their own techniques, tooling, and targeting preferences, so the TTP spread inside any given Gunra incident can vary more than it would under a single group's operational control.
CISA's advisory maps the Windows encryptor's behavior: it uses native OS API calls to enumerate files across all accessible drive letters before encryption, which means endpoint detection engineering focused on suspicious FindFirstFileW / FindNextFileW call chains from unknown binaries remains a viable detection strategy.
What the advisory doesn't say
The joint advisory does not disclose observed ransom demand ranges, whether any U.S. government or critical infrastructure victims have paid, or the identity of specific victim organizations, standard practice for #StopRansomware publications, but worth noting given the breadth of sectors listed. The victimology spans the Americas, Europe, Middle East, Africa, and Asia-Pacific, and the DLS is active.
Organizations should not expect a decryption tool. CISA's guidance centers on the basics that keep working: patch the internet-facing VPN and firewall appliances, maintain offline immutable backups, and segment networks to limit lateral movement post-compromise. That these remain the lead recommendations (years after Conti, after the JRTF, after CIRCIA) is itself the observation.
Published ·Deep Fathom