The Cybersecurity and Infrastructure Security Agency (CISA), FBI, and U.S. and international partners on Aug. 10 issued a joint cybersecurity advisory warning that Gunra ransomware actors are targeting critical infrastructure organizations worldwide, including government, healthcare, and financial services organizations.
The advisory identifies Gunra as a ransomware-as-a-service operation whose affiliates exploit vulnerabilities in internet-facing devices to gain initial access. According to an Aug. 10 CISA press release, the actors have exploited two common vulnerabilities and exposures – CVE-2024-55591 and CVE-2025-24472 – before stealing and encrypting victim data.
“Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations,” said Chris Butera, CISA acting executive assistant director for cybersecurity.
“With our partners, CISA encourages organizations to urgently mitigate vulnerabilities identified in this advisory, implement recommended actions, and adopt security measures aligned to CPGs,” Butera added.
CISA released the advisory alongside the FBI, Department of Defense Cyber Crime Center, National Security Agency, U.S. Secret Service, and the Republic of Korea’s National Police Agency.
The agencies said Gunra affiliates have targeted organizations in the healthcare and public health, financial services, government services and facilities, and professional and nonprofit services sectors.
After gaining access, the ransomware actors employ a double-extortion model that combines data exfiltration with encryption. Gunra actors negotiate with victims through a Tor-based portal and threaten to publish stolen information if a ransom is not paid within five to seven days, according to the advisory.
The advisory provides organizations with detection guidance, indicators of compromise, steps to take when a potential compromise is detected, and mitigation measures aligned with CISA’s Cross-Sector Cybersecurity Performance Goals.
CISA and its partners are urging organizations to keep operating systems, software, and firmware up to date and prioritize patching known exploited vulnerabilities in internet-facing systems.
The agencies also recommend maintaining immutable backups in physically separate and segmented locations and testing them offline. Organizations should segment networks to limit attackers’ ability to move laterally from an initially compromised device, according to the advisory.