NSA, FBI and Partners Issue Joint Guidance on Gunra Ransomware Threat

The National Security Agency (NSA), Federal Bureau of Investigation (FBI), and partner organizations have released new joint cybersecurity guidance to help network defenders identify and protect against Gunra ransomware, an emerging ransomware-as-a-service operation targeting organizations across the United States and around the world.

Released as part of the ongoing #StopRansomware initiative, the advisory provides defenders with information on tactics, techniques, procedures, and indicators of compromise associated with Gunra. The goal is to give organizations actionable information they can use to strengthen defenses and respond more effectively to potential intrusions.

Gunra first emerged as a ransomware variant in 2025 before expanding into a ransomware-as-a-service (RaaS) operation in 2026. Under the RaaS model, affiliates can use the ransomware to conduct attacks against their own targets. Gunra operators have targeted government agencies, critical infrastructure, and organizations across numerous other sectors worldwide.

The threat actors employ a double-extortion strategy, stealing sensitive information before encrypting victims' systems. If a ransom is not paid, the attackers threaten to release the stolen information through a dedicated leak site or sell the data. According to the FBI, information collected from victims has included business-critical documents, databases, personally identifiable information, and internal email communications.

Source: This article is based on information originally published by the National Security Agency on August 10, 2026. Read the original NSA announcement and access the joint Gunra cybersecurity advisory here: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4567025/nsa-joins-fbi-and-others-in-releasing-guidance-to-defend-against-gunra-ransomwa/