Gunra

☆ pin

Also known as Golden Community

Reports

First seen

May 22, 2026

Last seen

Aug 11, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Other ×5 Government ×2 Manufacturing ×2 Professional Services ×2 Transport & Logistics ×1 Technology ×1 Healthcare ×1 Financial Services ×1

Victim regions

×1

×2

Spain×2

South Korea×1

Brazil×1

United Kingdom×1

United States×1

Thailand×1

Indonesia×1

Mexico×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×6T1190 Exploit Public-Facing Application ×6T1133 External Remote Services ×4T1567 Exfiltration Over Web Service ×3T1566 Phishing ×2T1021.002 Remote Services: SMB/Windows Admin Shares ×2T1490 Inhibit System Recovery ×2T1070.001 Indicator Removal: Clear Windows Event Logs ×2T1078.001 Valid Accounts: Default Accounts ×1T1598 Phishing for Information ×1T1547 Boot or Logon Autostart Execution ×1T1003.003 OS Credential Dumping: NTDS ×1

Indicators

domain ×27cve ×8filename ×4url ×3email ×1hash_sha256 ×1ip_v4 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2025-24472 (exploited)CVE-2024-55591 (exploited)CVE-2024-5559 (exploited)

Recent reports

Critical

Gunra

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

US and South Korea warn of Gunra ransomware targeting government agencies

Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

FBI, South Korea warn of Gunra ransomware gang targeting critical infrastructure

U.S. and South Korean agencies warn of Gunra ransomware-as-a-service gang targeting critical infrastructure

CISA/FBI Advisory: Gunra Ransomware-as-a-Service Targeting Government and Critical Infrastructure

Gunra ransomware gang publishes PT All Cosmos Biotek as victim

Gunra ransomware gang publishes worldtube as victim

Lazarus Group sharing cyberattack tools with Gunra ransomware operators targeting South Korea

Gunra Ransomware Claims Siam Stabilizers and Chemicals Co., Ltd.

Gunra ransomware group publishes Weilhotel as victim

Gunra ransomware gang publishes Dissinger and Dissinger Law Firm as victim

Gunra ransomware gang publishes New Tiles S.L. as victim

Gunra ransomware gang claims Pirámide Seguros as victim

Gunra ransomware gang claims new victim: on-us

Gunra ransomware group publishes Yuditec S.A. as victim

Gunra ransomware gang publishes MHE9 Logística Ltda as victim

Gunra ransomware gang publishes Suárez & Clavera as victim

Gunra ransomware claims Cambridge Law Chambers as victim

Gunra ransomware gang publishes STAREMPIRE as new victim

Gunra ransomware gang publishes SOMAFIX as new victim

Gunra ransomware gang claims victim: Cablematic Dos Mil SLU (Spain)