Просмотр новости
Найдите то, что Вас интересует
Спутники
РН
SpaceX
Роскосмос
NASA
СпутникиРНSpaceXРоскосмосNASAThe ransomware-as-a-service outfit has gone after a range of critical infrastructure sectors across the globe.
The post U.S., South Korean government agencies caution to be on lookout for Gunra ransomware gang appeared first on CyberScoop.
U.S. and South Korean cyber agencies warned Monday about a ransomware-as-a-service outfit, Gunra, that reportedly recruits ethical hackers and penetration testers and benefits from North Korean government-linked hackers’ tools to target government and critical infrastructure organizations.
Gunra has gone after sectors such as academia, financial services and insurance, government services and facilities, healthcare, manufacturing and construction, media, retail, transportation and utilities. Its global scope is far-ranging, according to Monday’s alert: Africa, the Americas, the Asia-Pacific, Europe and the Middle East.
“Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations,” said Chris Butera, acting assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency, which produced the advisory with the Department of Defense’s Cyber Crime Center, FBI, National Security Agency, Secret Service and Republic of Korea’s National Police Agency.
The alert is part of the #StopRansomware series, a joint FBI-CISA project aimed at network defenders.
The FBI first took notice of Gunra in April of last year. The double-extortion group established a data leak site on Tor to list victims and publish purloined data. By January of this year, Gunra had launched a formal ransomware-as-a-service affiliate and was growing in its ambition, Monday’s alert states.
“The FBI observed the group adopting new branding aliases (notably operating under the name Golden Community) to support this expansion,” it reads. “Gunra has further commercialized its platform by actively recruiting penetration testers and ethical hackers to serve as initial access brokers, offering a share of the ransom profits in exchange for enterprise network access.”
Gunra seeks initial access with known vulnerabilities in internet-facing devices like firewalls or virtual private networks, and is based on or influenced by the Conti ransomware code leaked in 2022, according to the agencies.
Research published in July by a South Korean cybersecurity firm took note of Gunra overlap with Lazarus Group, although it doesn’t explicitly mention the latter group’s name.
“These commonalities suggest that although the state-sponsored threat group and the Gunra ransomware group appear to be separate threat actors with different ultimate objectives, they may have shared certain techniques, tools, and infrastructure or collaborated to a limited extent during the attacks,” AhnLab wrote in its report.
That kind of North Korean government-ransomware gang collaboration dates back to at least 2024. Nor is Gunra alone among ransomware-as-a-service outfits recruiting penetration testers.
| # | Наименование новости | Тональность | Информативность | Дата публикации |
|---|---|---|---|---|
| 1 | The ‘year of AI’: 2026 sees influx of ransomware attacks | -2 | 6 | 26-06-2026 |
| 2 | Lawmakers ponder terrorism designations, homicide charges over hospital ransomware attacks | 0 | 6.49 | 21-04-2026 |
| 3 | CISA gives US federal agencies three days to fix a VPN bug under attack by a ransomware gang | 0 | 8 | 09-06-2026 |
| 4 | North Koreans behind nearly half of US tech industry hacks, says CrowdStrike | -2 | 7 | 10-06-2026 |
| 5 | South Korea hits Coupang with $400M+ fine for data breach that affected millions | 0 | 8 | 11-06-2026 |
| 6 | Ransomware in 2026: More groups, more victims, no slowdown | 0 | 12.14 | 24-07-2026 |
| 7 | Reuters: хакеры из КНДР разрабатывают инструменты искусственного интеллекта для кибератак | 0 | 10 | 10-08-2026 |
| 8 | Coast Guard says it is monitoring cyberattack that disrupted North Carolina’s ports | 0 | 6.55 | 07-08-2026 |
| 9 | Huntress warns about attack spree that hit 30 SonicWall customers in 2 days | 0 | 14.43 | 29-07-2026 |
| 10 | Ransom Cartel creator sentenced to 16 years in prison | 0 | 13.5 | 06-08-2026 |