Gunra Ransomware Targets Windows and Linux, CISA Warns

A joint FBI, CISA, DC3, NSA, U.S. Secret Service, and South Korean police advisory warns that Gunra ransomware now operates as a cross-platform ransomware-as-a-service. The agencies describe real intrusions that began at internet-facing VPN and firewall appliances, moved through stolen accounts and sessions, exfiltrated business data, and ended with encryption on Windows or Linux systems.

The immediate response depends on the platform. Windows samples observed by the agencies appended .ENCRT or, in one case, .CRYPT. A Linux variant can append .GNRA. If Linux files are involved, responders should preserve encrypted files, timestamps, ransom notes, and logs before rebuilding: the advisory says some ELF samples use predictable time-based key generation that specialists may be able to reconstruct.

Gunra indicators do not all mean the same thing

.ENCRT or .CRYPT files

These are documented Windows indicators. Isolate the host and protect untouched backups; the advisory does not describe a general Windows decryptor.

.GNRA files on Linux

Do not discard encrypted copies or reset timestamps. Preserve the filesystem and logs for specialist recovery assessment.

R3ADM3.txt ransom note

The main advisory text uses this name. Its ATT&CK table also shows R34DM3.txt, so identify the incident from several artifacts, not one filename.

Unexpected forticloud-sync account

The advisory links this malicious super-user account to exploitation of FortiOS/FortiProxy authentication-bypass flaws CVE-2024-55591 and CVE-2025-24472.

File extensions and note names are triage clues, not proof by themselves. Preserve a copy, compare hashes, record the first affected time, and check whether the same account, remote-access, and exfiltration evidence appears elsewhere.

How Gunra moves from the perimeter to encryption

The FBI observed Gunra affiliates exploiting known flaws in internet-facing Fortinet devices and abusing weak or exposed VPN access. In one case, attackers captured VDI credentials and session data, modified authentication processing so an attacker-selected one-time password always worked, and used stolen access to move through Active Directory and IT virtual desktops.

Before encryption, the actors collected business documents, databases, personal data, and internal email. The advisory says a malicious main.exe targeted OneDrive and SharePoint data in at least one incident. Attackers also used tools such as Impacket, Rclone, FileZilla, 7-Zip, and WinRAR. Each tool can be legitimate, so the useful signal is the combination of unusual privileged use, remote sessions, archive creation, and outbound transfer.

Gunra then encrypts user data while avoiding selected Windows system folders and executable file types. That can leave a machine responsive even while useful files disappear, a warning also seen in the DeadLock ransomware response. The actors may delete shadow copies and backups, so a working desktop is not evidence that damage has stopped.

What to do in the first hour

1. Isolate affected systems. Disconnect compromised endpoints, servers, VPN appliances, and storage paths from the network without wiping them.
2. Protect clean backups. Suspend replication if it is copying encrypted data. Keep offline or immutable copies physically and logically separated.
3. Preserve evidence. Save encrypted files, ransom notes, timestamps, memory or disk images when possible, authentication logs, VPN/firewall configuration, VDI logs, Active Directory changes, and cloud audit records.
4. Contain identities. Disable unknown accounts, revoke sessions and tokens, rotate exposed administrator and service credentials from a known-clean system, and restore MFA processing from trusted media.
5. Scope exfiltration. Review OneDrive, SharePoint, archive-tool, FTP, cloud-storage, and egress activity before assuming the event was encryption-only.
6. Separate recovery by platform. For Windows, plan restoration from verified clean backups. For Linux .GNRA cases, preserve originals and consult an incident-response or cryptography specialist before changing timestamps or rebuilding.
7. Report and coordinate. Follow legal and regulatory duties and share useful indicators with the appropriate national cyber authority or law enforcement. CISA and the FBI discourage ransom payment because it does not guarantee recovery.

After evidence capture and containment, scan isolated Windows endpoints before reconnecting them. A full Gridinsoft anti-ransomware check can help identify remaining payloads or persistence, but it cannot decrypt already encrypted files or prove that cloud data was not stolen.

How to reduce the Gunra entry path

• Patch internet-facing VPN, firewall, and RDP infrastructure, including the Fortinet flaws named in the advisory.
• Remove default and unused accounts, require phishing-resistant MFA, and alert on new privileged users such as forticloud-sync.
• Segment administrator workstations, VDI, Active Directory, backup systems, and file storage so one VPN session cannot reach them all.
• Test restoration from offline, immutable backups; a backup that attackers can enumerate or delete is part of the attack surface.
• Investigate unusual use of remote administration, archive, and transfer tools rather than blocking them without context.

References

1. Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, and partner agencies. “#StopRansomware: Gunra Ransomware” (AA26-222A), published August 10, 2026; accessed August 11, 2026. joint advisory.
2. Cybersecurity and Infrastructure Security Agency. “#StopRansomware Guide,” accessed August 11, 2026. incident-response guide.