The Cybersecurity and Infrastructure Security Agency, FBI and international partners have issued a joint advisory warning healthcare organizations about Gunra, a ransomware-as-a-service group actively targeting the sector.
Gunra first emerged in April 2025 as a ransomware variant built from leaked Conti source code, then expanded into a ransomware-as-a-service operation in 2026, according to the Aug. 10 notice. The group has hit healthcare and public health, financial services, government and professional/nonprofit organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific region, with attacks accelerating this year.
Gunra actors gain initial access primarily by exploiting two authentication-bypass vulnerabilities, CVE-2024-55591 and CVE-2025-24472, in Fortinet’s FortiOS and FortiProxy products. Once inside a network, the group uses a double-extortion model, encrypting data and threatening to leak stolen files on a dark web site if a victim doesn’t pay within five to seven days, negotiating through a Tor-based portal. Gunra is also recruiting affiliates from other ransomware groups by offering an 80% cut of ransom proceeds.
CISA’s advisory recommends organizations prioritize patching known exploited vulnerabilities in internet-facing systems, including virtual private network (aka VPN) gateways and remote desktop protocol (RDP)-exposed infrastructure, maintain offline immutable backups, and segment networks to limit lateral movement. The American Hospital Association’s John Riggi and Scott Gee are available to member hospitals for follow-up guidance on the threat.
Health systems already contending with elevated ransomware activity in 2026 now have another named, actively evolving threat to factor into vulnerability management and incident response planning.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
