New Advisory Warns of Gunra’s Double Extortion Campaign

A joint advisory from US and Republic of Korea authorities has put a spotlight on Gunra, a ransomware-as-a-service (RaaS) operation that’s actively targeting government agencies and critical national infrastructure. The warning, published on August 10, details how the group is exploiting two known Fortinet vulnerabilities to gain a foothold in high-value networks.

The advisory comes from the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and other US agencies, alongside South Korea’s National Police Agency (KNPA). It paints a picture of a sophisticated operation that doesn’t just lock files—it steals vast amounts of data first, then demands a hefty ransom.

Gunra’s code traces back to leaked Conti ransomware source code from 2022. The group first appeared in April 2025, but by early 2026 it had structured itself into a proper RaaS affiliate program, advertised on dark web forums. It’s also adopted new branding, sometimes operating under the alias “Golden Community.”

Legacy Fortinet Vulnerabilities Still Effective

The FBI has observed Gunra specifically targeting two legacy Fortinet vulnerabilities. Both are authentication bypass flaws affecting specific versions of FortiOS and FortiProxy.

• CVE-2024-55591: A critical flaw that lets a remote attacker gain super-admin privileges via crafted requests to the Node.js websocket module.
• CVE-2025-24472: A high-severity vulnerability allowing a remote unauthenticated attacker, who knows upstream and downstream device serial numbers, to gain super-admin privileges on the downstream device when Security Fabric is enabled, via crafted CSF proxy requests.

Patches are available for both. Yet the advisory notes that victims are still getting hit—often even after applying fixes.

Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, explains why. “Patching fixes the entry point. It does nothing about an authentication backdoor already embedded in the MFA flow. I’ve seen organizations close the vulnerability and declare themselves clean while the attacker’s persistence mechanism sat untouched in the auth stack.”

How Gunra Operates Once Inside

The advisory details several observed techniques. In one case, Gunra actors accessed an administrator account for an SSL-VPN appliance by exploiting default credentials when account lockout controls weren’t in place. They then downloaded OpenSSH to establish connections between compromised systems and an external attacker-controlled server.

In another example, attackers modified authentication processing files on a corporate VDI authentication portal server, enabling them to continuously bypass multi-factor authentication (MFA). These aren’t flashy exploits—they’re quiet, persistent adjustments that let the group move freely.

Stealthy Exfiltration of Massive Data Volumes

Gunra’s approach is built around stealth. The group primarily conducts malicious activities and internal reconnaissance between 10:00 PM and 6:00 AM in the victim’s time zone, when administrators are typically offline. They also delete system and network access logs, and clear command history to hinder detection.

Roman Sannikov, global research coordinator at iCOUNTER, warns security teams to take note. “If your detection coverage drops off overnight, that’s exactly the gap this group, now also operating under the alias Golden Community, is built to exploit.”

The ransomware binary includes filtering rules to focus only on user data files, avoiding wasted encryption resources on non-critical files. The FBI has observed actors using a malicious executable to exfiltrate data from Microsoft OneDrive and SharePoint. In at least one case, they successfully exfiltrated tens of terabytes of data by creating compressed archives and sending them to the file-sharing service Mega.

Ransom Demands in the Tens of Millions

Gunra’s ransom notes typically start negotiations by demanding tens of millions of dollars—a figure the report describes as “arbitrarily high.” Victims get five to seven days to begin negotiations via a Tor-based portal. In some cases, the group has even emailed management staff directly at victim organizations.

If victims don’t engage or pay, the group threatens to publish leaked data on its data leak site. This is classic double extortion: pay to decrypt your files, and pay again to keep your data private.

Victims span regions worldwide and include healthcare, financial services, government organizations, and critical manufacturing sectors.

Defending Against Gunra

The advisory urges organizations to focus on three key areas to counter Gunra’s tactics:

• Prioritize patching known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure.
• Implement and test offline, immutable backups stored in a physically separate, segmented location to ensure recoverability without paying a ransom.
• Segment networks to restrict lateral movement from an initially compromised device to other systems.

The message is clear: this group is patient, stealthy, and well-organized. They’re exploiting known flaws in legacy systems, and they’re doing it under the cover of night. Organizations in critical sectors need to patch fast, monitor around the clock, and assume that MFA alone won’t save them. For more on protecting your infrastructure, check out our guide on ransomware defense strategies for enterprises and learn how to harden VPN gateways against cyberattacks.

The clock is ticking. If you haven’t patched those Fortinet vulnerabilities yet, consider this your wake-up call.

Senate backs Cassady for top cyber diplomacy post

The Senate on Friday confirmed Adam Cassady as the next U.S. ambassador for cyber and digital policy, filling a role that has sat empty since the start of the Trump administration.

The vote was 51-47, part of a broader package covering more than 70 nominees. Cassady becomes only the second person to hold the ambassador-at-large position. The first, Nate Fick, stepped down in early 2025.

Cassady arrives from the National Telecommunications and Information Administration, where he served as a senior official. His previous stops include the Federal Communications Commission.

A bureau reshaped by reorganization

The job Cassady is walking into looks different than it did a year ago. The State Department’s Bureau of Cyberspace and Digital Policy — which he will now lead — was split into three separate entities during a major reorganization. A new Bureau of Emerging Threats was carved out, and the cyber bureau’s staffing was cut.

Exactly how much influence Cassady will wield is an open question. The restructuring diluted the bureau’s scope, and the role’s responsibilities have shifted. Still, the confirmation gives the U.S. a permanent face for international cyber diplomacy after more than a year of vacancy.

Quiet hearing, big questions on China chips

Cassady faced little pushback at his April confirmation hearing. He told senators the U.S. should work with “trusted partners who share our commitment to secure, resilient and open digital ecosystems.”

But he was less definitive on one hot-button issue: whether the U.S. should allow advanced semiconductor shipments to China.

“I don’t have a strong point of view on that topic yet. Certainly I will very, very quickly develop one,” Cassady said at the time.

He added that the administration was trying to “balance very important competing considerations as it relates to both economic prosperity and national security.” If confirmed, he said, that issue would be one he’d “dig very deeply into.”

The Nvidia H200 question

The chip question isn’t hypothetical. Last month, Jeffrey Kessler, undersecretary of Commerce for industry and security, told the House Foreign Affairs Committee that “very few” of Nvidia’s H200 artificial intelligence chips have reached China and Hong Kong — an indication that shipments are quietly underway.

That puts Cassady in an awkward spot. His bureau will likely have a voice in how the U.S. frames these export decisions on the world stage, even if Commerce holds the actual levers.

What comes next for the cyber ambassador role

Cassady’s confirmation ends a period of uncertainty for U.S. cyber diplomacy. The ambassador post was created under the Biden administration, and Fick’s departure left a gap that some allies were watching closely.

The new ambassador inherits a bureau with fewer resources and a narrower mandate. Whether he can restore its influence — or even define its new boundaries — remains to be seen.

For now, the Senate has spoken. Cassady is in. The hard part starts now.

For more on how the State Department’s cyber operations are structured, see our explainer on U.S. cyber diplomacy strategy. And if you’re tracking export controls, check out this breakdown of AI chip restrictions on China.

The State of Play: 30% Hit, Half Unprepared

New data from Make UK paints a stark picture. Nearly a third of British manufacturers — 30% to be precise — suffered a cyber incident in the last year, either directly or via their supply chain. Yet only half have a formal cyber incident response plan in place.

The trade association’s report, Cyber Security in Manufacturing, published August 10, draws on its Cyber Resilience 2026 survey and government data. It’s not a pretty read.

Operational Chaos: The Real Cost of an Attack

Cyber attacks aren’t just IT headaches. They halt production lines, delay shipments, and break supply chains.

• 31% of affected firms saw reduced production capacity or operational delays
• 23% faced component or material shortages
• 31% reported delays delivering products to customers

That’s financial pain, not just technical disruption. In manufacturing, a stalled line means missed orders and lost revenue — fast.

Governance Gaps: Leadership and CISO Roles Missing

While 51% have a formal incident response plan, that leaves 49% without one. Similarly, only 45% have designated senior leadership responsibility for cybersecurity. Fewer than a quarter — 23% — employ a dedicated CISO.

Andrew Lintell, general manager for EMEA at Claroty, calls the 2025 Jaguar Land Rover attack a “watershed moment” — but notes many firms still haven’t acted.

“The reality is the industrial control systems, sensors and connected machinery on the factory floor that most IT centric security tools were never built to see,” he says. “You can’t defend or manage, what you can’t see.”

Commercial Pressure: Customers Demand Cyber Proof

Cyber readiness is now a commercial factor. Partners and customers increasingly require proof of data protection, uptime, and supply chain integrity before signing contracts. Yet nearly a third of manufacturers either lack cyber insurance or don’t know if their coverage applies to disruption.

That’s a risky position when one incident can bring operations to a standstill.

Make UK’s Recommendations: Move Beyond Compliance

The report urges manufacturers to treat cybersecurity as a board-level priority — not a backend IT concern. Key actions include:

• Formalize and stress-test incident response plans regularly
• Implement mandatory cybersecurity awareness training for all staff
• Strengthen supplier assurance protocols
• Review insurance policies to ensure coverage for business interruption

Passive compliance isn’t enough. Firms need tested recovery plans and proactive governance.

For more on building resilience, see our guide on manufacturing cybersecurity best practices and industrial cyber risk management strategies.