Gunra ransomware: what the advisory means, and why Linux victims can decrypt without paying
On August 10, 2026, CISA, the FBI, NSA, the Department of Defense Cyber Crime Center, the Secret Service, and South Korea's National Police Agency issued joint advisory AA26-222A. The subject is Gunra, a ransomware operation that has been expanding globally since converting to a ransomware-as-a-service model in January 2026.
When six agencies across two countries issue a joint advisory, it means the threat has reached a scale and geographic spread that justifies coordinated disclosure. That is a meaningful signal by itself. The advisory details are worth working through carefully, and one piece of technical information in particular is immediately actionable.
Background: Gunra and its origins
Gunra first appeared in April 2025 as a double-extortion ransomware variant built on leaked Conti source code. The Conti leak in 2022 provided a functional ransomware codebase that multiple successor groups adapted into their own operations. Gunra is one of them.
The ransomware-as-a-service conversion in January 2026 means Gunra now operates with a builder that affiliates use to generate customized Windows and Linux payloads. The core operation provides infrastructure, a Tor-based negotiation portal, and a dedicated leak site. Affiliates handle initial access and deployment.
Who is targeted
Advisory AA26-222A documents victim organizations across healthcare and public health, financial services, critical manufacturing, transportation systems, government facilities, utilities, academia, media, retail, and professional services. Geographically: the Americas, Europe, the Middle East, Africa, and Asia-Pacific. The targeting profile is broad by design. Ransomware-as-a-service operations benefit from volume; narrow sector targeting limits revenue.
How Gunra gets in
The documented initial access vector is Fortinet SSL VPN. Two specific vulnerabilities are cited: CVE-2024-55591 and CVE-2025-24472. Both are authentication bypass vulnerabilities in Fortinet's FortiOS SSL VPN. Both have patches available. Both have been actively exploited since before Gunra's current campaign.
If your network perimeter includes Fortinet SSL VPN devices that have not been updated to address these two CVEs, your exposure to Gunra initial access is direct. After initial access, lateral movement uses SMB and RDP. Gunra actors conduct reconnaissance before encryption, exfiltrate data for double-extortion leverage, and then deploy the encryptor.
The Linux decryptor weakness
Here is the immediately actionable detail from the advisory's technical appendix: Gunra's Linux ELF variant uses a weak pseudo-random number generator to generate encryption keys, and the PRNG is seeded with system time at the moment of encryption.
System time is predictable. File timestamps on the encrypted files record when encryption occurred. From those timestamps, a defender can mathematically reconstruct the seed value and derive the encryption key.
This means: if you have Linux systems encrypted by Gunra, and you have not already wiped those systems, you may be able to recover your files without paying the ransom. The advisory confirms this weakness was identified as of March 2026. Incident responders working Gunra cases should check whether the victim's Linux-encrypted data is recoverable before any ransom negotiation proceeds.
The Windows variant does not have the same flaw. The Linux-specific weakness is worth communicating specifically to organizations that primarily run Linux infrastructure in the targeted sectors.
What to do now
For organizations that have not been hit: patch Fortinet SSL VPN against CVE-2024-55591 and CVE-2025-24472, review remote access configurations, and audit for indicators of compromise from the advisory. IOCs, YARA rules, and Snort signatures are available at cisa.gov/news-events/cybersecurity-advisories/aa26-222a.
For organizations that have been hit on Linux: before paying any ransom, contact your incident response team and discuss the PRNG weakness. File timestamps and the encryption timestamp may allow key reconstruction.
For security teams building detection: the advisory documents lateral movement via SMB and RDP. Gunra actors spend time inside the environment before encrypting. Detection opportunities exist at the lateral movement phase, not only at the encryption event.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are managing a ransomware incident or hardening your perimeter against current attack vectors.