.png)
Gunra / Golden Community Ransomware: Six Agencies, Conti's Source Code, and Your Unpatched VPN
Breach Summary
On August 10, 2026, six government agencies — the FBI, CISA, the NSA, the U.S. Secret Service, the Department of Defense Cyber Crime Center, and South Korea's National Police Agency — issued joint advisory AA26-222A on the Gunra ransomware-as-a-service operation.
Six agencies across two countries is not a routine advisory. Gunra is built on the leaked Conti source code, has been operating since April 2025, launched a formal affiliate program in January 2026 under the alias Golden Community, and has compromised hospitals, financial institutions, utilities, and government facilities across the Americas, Europe, the Middle East, and Asia-Pacific.
The initial access vector named in the advisory is the one that should hold a deal team's attention: unpatched, internet-facing VPN and firewall infrastructure.
What Happened
The FBI first observed Gunra in April 2025 as a double-extortion ransomware variant derived from the Conti source code leaked in 2022 — placing it in the same lineage as Black Basta, Rhysida, and Royal/BlackSuit. The operators established a Tor-based dedicated leak site almost immediately to name victims and publish exfiltrated data.
In January 2026, Gunra expanded into a structured ransomware-as-a-service affiliate program advertised on dark web forums. Affiliates receive a management panel, a configurable ransomware builder, cross-platform locker payloads, and structured affiliate documentation. The FBI observed the group adopting the alias Golden Community to support the expansion.
The operation went further than most RaaS programs: it began actively recruiting penetration testers and ethical hackers to serve as initial access brokers on a revenue-share basis. That is a labor market, not a criminal crew.
By August 2026 the victim set spanned hospitals, financial institutions, utilities, and government facilities across the Americas, Europe, the Middle East, and Asia-Pacific — sufficient breadth to prompt a six-agency joint advisory across two countries.
Attack Vector Detail
Per AA26-222A, Gunra affiliates primarily gain initial access by exploiting known vulnerabilities in internet-facing VPN and firewall infrastructure, and through RDP-exposed systems. These are not zero-days. They are CVEs with patches available, sitting unpatched on the edge of the network.
Post-access tradecraft mapped in the advisory:
- Credential access — NTDS.dit dumping to extract domain credential hashes.
- Lateral movement — pass-the-hash, SMB, and RDP.
- Collection and exfiltration — a custom executable (
main.exe) for data collection, plus SharePoint data exfiltration. RClone and FileZilla for transfer. - Defense evasion — indicator removal and Volume Shadow Copy manipulation to defeat local recovery.
- Tooling — almost entirely legitimate software: FileZilla, Amass, RClone, Sliver, 7-Zip, WinRAR, DBeaver, Slack, Visual Studio Code, MobaXterm, AnyDesk. Living off the land, using tools that appear in normal admin activity.
Ransom negotiation runs through a Tor portal. The double-extortion sequence is exfiltrate first, encrypt second, publish if unpaid.
Breach Pattern Timeline
- 2022 — Conti source code leaked, seeding a generation of derivative families including Black Basta, Rhysida, and Royal/BlackSuit.
- April 2025 — FBI first observes Gunra. Tor leak site established almost immediately.
- January 2026 — Gunra launches a formal RaaS affiliate program on dark web forums. Adopts the Golden Community branding alias.
- Early–mid 2026 — Commercialization deepens; the operation recruits penetration testers as initial access brokers on a revenue-share basis.
- August 10, 2026 — Six-agency joint advisory AA26-222A published, covering victims across the Americas, Europe, the Middle East, and Asia-Pacific.
Related Cloudskope profiles: Conti, Royal / BlackSuit, LockBit, ALPHV / BlackCat.
Executive Lessons
Five actions, directly from the advisory:
- Inventory every internet-facing VPN, firewall, and RDP-exposed system, and verify patch status against the CISA KEV catalog. This is the single highest-value action against this specific threat.
- Implement and test offline, immutable, segmented backups. Test the restore. An untested backup is a hypothesis.
- Hunt for the named tooling in your environment — RClone, Sliver, AnyDesk, MobaXterm appearing where they have no business reason to exist.
- Monitor for NTDS dumping and pass-the-hash indicators. These are the credential-access and lateral-movement stages where the attack is still interruptible.
- Assume SharePoint is an exfiltration target. The advisory names it specifically. Review what lives there and who can reach it.
Private Equity Implications
Gunra converts a familiar diligence line item into a priced risk.
The unpatched edge appliance is now a named, federally-documented attack path. A target running an internet-facing VPN or firewall with a KEV-listed unpatched CVE is not carrying a theoretical vulnerability. It is carrying the specific entry point that six governments jointly warned about. That is a finding with a defensible remediation cost attached, which makes it a repricing or escrow conversation rather than a note in an appendix.
Portfolio-wide exposure is correlated. If the sponsor's portfolio companies use the same VPN vendor — common, because operating partners standardize — a single unpatched CVE is a portfolio-level event, not a company-level one. That correlation does not appear in company-by-company assessments.
Healthcare and critical infrastructure holdings carry elevated exposure. The advisory names those sectors specifically among Gunra's victims.
The diligence question is narrow and cheap to answer: what internet-facing network appliances does this company run, what firmware version, and is any KEV-listed CVE unpatched? It takes an afternoon. See cyber due diligence.
How Cloudskope Can Help
The Gunra entry point is an unpatched internet-facing appliance. Cloudskope's SARTUS™ assessment covers external attack surface, cloud configuration drift, credential exposure, and active-compromise indicators over three days, then closes what can be closed through configuration and policy correction in three more. Findings requiring firmware, licensing, or hardware land in the risk register with a documented path.
For sponsors, we run this across portfolio companies to answer the VPN-patch question at portfolio level rather than one company at a time. Book a strategy session.
Frequently Asked Questions
What is Gunra ransomware?
Gunra is a ransomware-as-a-service operation first observed by the FBI in April 2025, built on the Conti ransomware source code leaked in 2022. It operates a double-extortion model and expanded into a formal affiliate program in January 2026, also branding itself Golden Community.
What is advisory AA26-222A?
AA26-222A is a joint cybersecurity advisory published August 10, 2026 by the FBI, CISA, NSA, U.S. Secret Service, Department of Defense Cyber Crime Center, and South Korea's National Police Agency, detailing Gunra's tactics, techniques, procedures, and indicators of compromise.
How do Gunra affiliates get in?
Primarily by exploiting known vulnerabilities in internet-facing VPN gateways and firewall infrastructure, and through RDP-exposed systems. These are patchable CVEs, not zero-days.
What makes Gunra different from other ransomware groups?
The commercialization. Gunra supplies affiliates with a management panel, configurable ransomware builder, cross-platform payloads, and structured documentation, and actively recruits penetration testers as initial access brokers on revenue share. The operating model lowers the skill floor required to execute a sophisticated attack.
What should organizations do first?
Patch internet-facing VPN and firewall infrastructure against known exploited vulnerabilities, and implement offline, immutable, segmented backups that are tested for restore. Those two controls address the entry point and the recovery path respectively.