South Korea's cybersecurity and intelligence agencies, CISA and the FBI issued a joint warning this month about Gunra, a double-extortion ransomware operation that emerged in April 2025 and launched a formal ransomware-as-a-service programme in January 2026.
A joint advisory across three countries usually signals volume. This one is more interesting for what it says about targeting.
The two CVEs
| Product | CVE | Year |
|---|---|---|
| Schneider Electric PowerLogic P5 | CVE-2024-5559 | 2024 |
| Fortinet FortiOS / FortiProxy | CVE-2025-24472 | 2025 |
Neither is new. The Schneider flaw is two years old. Neither is exotic.
The Schneider entry is the one that should stop an infrastructure operator. PowerLogic P5 is a protection relay — power distribution equipment, not IT. A ransomware crew with a working exploit for it is a ransomware crew that has read the same OT-convergence memo everyone else has.
Where the victims are
51 victims listed since April 2025. Concentrated in:
- South Korea
- Brazil
- Spain
- Thailand
- Hong Kong
Three US and Canadian victims total.
That distribution is unusual enough to be worth naming. A ransomware operation with 51 victims and three in North America is not choosing targets the way most RaaS affiliates do. It suggests affiliate geography rather than deliberate avoidance, but either way, a US-centric threat feed would have shown this group as barely present.
Sectors: healthcare and public health, financial services, government services and facilities, professional and nonprofit services.
The TTPs are entirely conventional
- Phishing as the primary initial access vector
- SMB exploitation via Impacket —
psexec.py,smbclient.py - Credential dumping with
secretsdump.py - Exfiltration through OneDrive, SharePoint and MEGA
- MFA bypass through OTP manipulation
- SSL-VPN exploitation for session hijacking
There is nothing on that list a defender has not seen. Impacket and secretsdump have been in every ransomware advisory for six years. Exfiltration through OneDrive and SharePoint is exfiltration through the tools the victim already trusts, which is why it works.
The MFA bypass through OTP manipulation is the item most worth checking against your own stack. Push-based and OTP-based MFA are not equivalent controls under a determined operator — the Teams vishing campaign that reached encryption in under 17 hours started from the same premise.
The Linux locker is broken
The group offers both Windows and Linux variants. The Linux version contains a cryptographic weakness that enables file recovery without paying.
That is a genuinely useful fact and it is buried in the advisory. If you are hit by the Linux locker, do not pay before checking whether recovery is possible.
It also says something about the operation's maturity. A crew that ships a broken Linux locker is a crew that built the Linux variant to widen the market, not because they had the engineering to do it properly.
Reading this against the wider picture
We covered the July ransomware surge led by Qilin and the pattern holds here: the volume is not coming from novel technique. It is coming from unpatched edge devices and phishing, executed at scale by affiliates.
The two CVEs in this advisory are 2024 and 2025. The gap between "patch available" and "patch applied" is where this entire industry lives.
What to do
- Patch CVE-2025-24472 (FortiOS/FortiProxy) and CVE-2024-5559 (PowerLogic P5) if you have not. Check the second one even if you think you have no Schneider gear — protection relays are owned by facilities, not IT.
- Alert on Impacket signatures.
psexec.pyandsecretsdump.pyhave recognisable behaviour and it is not subtle. - Watch outbound volume to OneDrive, SharePoint and MEGA. Especially MEGA, which has no business use in most organisations.
- Review your MFA method. OTP manipulation is on the list for a reason.
- If you are hit by the Linux variant, check for recovery before anything else.
One closing note on the geography: a group with 51 victims and three in North America will read as low-priority in most US-authored threat intel. If your operations are in Korea, Brazil, Spain, Thailand or Hong Kong, this advisory is about you specifically.
