Public health and healthcare groups, among others, are urged to be on the alert for a ransomware group actively targeting the sector, according to a warning issued by the FBI, Cybersecurity and Infrastructure Security Agency, and international partners, reports Becker’s Hospital Review.
The joint advisory said Gunra first emerged in April 2025 as a ransomware variant built from leaked Conti source code, then expanded into a ransomware-as-a-service operation in 2026.
The group has hit healthcare and public health, financial services, government and professional/NPOs across Africa, America, Europe, the Middle East, and the Asia-Pacific region, with attacks accelerating this year.
Gunra actors gain initial access primarily by exploiting two authentication-bypass vulnerabilities, CVE-2024-55591 and CVE-2025-24472, in Fortinet’s FortiOS and FortiProxy products.
Once inside a network, the group uses a double-extortion model, encrypting data and threatening to leak stolen files on a dark web site if a victim doesn’t pay within five to seven days, negotiating through a Tor-based portal.
Gunra is also recruiting affiliates from other ransomware groups by offering an 80% cut of ransom proceeds.
It employs multiple stealth and defence impairment techniques to hinder detection and analysis. While active within victim networks, Gunra actors typically attempt to mask their presence by deleting system/network access logs and clearing command history.
Additionally, to evade administrator detection, Gunra actors primarily conduct malicious activities and internal infrastructure reconnaissance during late-night and early-morning hours.
CISA’s advisory recommends organisations prioritise patching known exploited vulnerabilities in internet-facing systems, including virtual private network (aka VPN) gateways and remote desktop protocol (RDP)-exposed infrastructure, maintain offline immutable backups, and segment networks to limit lateral movement.
Health systems already contending with elevated ransomware activity in 2026 now have another named, actively evolving threat to factor into vulnerability management and incident response planning.
See more from MedicalBrief archives:
100 Romanian hospitals switch to pen and paper after cyber attack
Cyber hackers target South Africa’s healthcare system
Cyber attacks create havoc in state hospitals in SA, and globally
NHLS targets dented by 2024 cyber attack