The Cybersecurity and Infrastructure Security Agency, FBI and international partners have issued a joint advisory warning healthcare organizations about Gunra, a ransomware-as-a-service group actively targeting the sector.
Gunra first emerged in April 2025 as a ransomware variant built from leaked Conti source code, then expanded into a ransomware-as-a-service operation in 2026, according to the Aug. 10 notice. The group has hit healthcare and public health, financial services, government and professional/nonprofit organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific region, with attacks accelerating this year.
Gunra actors gain initial access primarily by exploiting two authentication-bypass vulnerabilities, CVE-2024-55591 and CVE-2025-24472, in Fortinet’s FortiOS and FortiProxy products. Once inside a network, the group uses a double-extortion model, encrypting data and threatening to leak stolen files on a dark web site if a victim doesn’t pay within five to seven days, negotiating through a Tor-based portal. Gunra is also recruiting affiliates from other ransomware groups by offering an 80% cut of ransom proceeds.
CISA’s advisory recommends organizations prioritize patching known exploited vulnerabilities in internet-facing systems, including virtual private network (aka VPN) gateways and remote desktop protocol (RDP)-exposed infrastructure, maintain offline immutable backups, and segment networks to limit lateral movement. The American Hospital Association’s John Riggi and Scott Gee are available to member hospitals for follow-up guidance on the threat.
Health systems already contending with elevated ransomware activity in 2026 now have another named, actively evolving threat to factor into vulnerability management and incident response planning.
