S. Korea, U.S. issue joint advisory on 'Gunra' ransomware attacks

Seoul, on August 11, the Korean National Police Agency (KNPA) urged domestic companies and institutions to bolster their defenses against the Gunra ransomware, following a joint cybersecurity advisory released in collaboration with U.S. authorities including the FBI and the National Security Agency. Ransomware, a malicious software that encrypts data and demands payment for its release, is the type of threat the advisory addresses.

The advisory specifically focuses on the latest attack techniques and indicators of compromise for the Gunra ransomware, a variant that emerged in 2025 and has since evolved into a ransomware-as-a-service operation targeting various sectors, including government and critical infrastructure, finance, healthcare, and manufacturing.

According to the advisory, the attackers breach critical infrastructure organizations by exploiting system vulnerabilities before deploying the ransomware, employing a double-extortion model where they encrypt data and threaten to publish it if the ransom is not paid. To effectively respond to these attacks, the KNPA advises companies and institutions to restrict external network access, apply the latest security patches, and enhance account management through multi-factor authentication.

The agency is actively investigating Gunra ransomware-related attacks and plans to strengthen response capabilities through international cooperation.