There’s a comforting belief a lot of business owners hold about ransomware: “if my files ever get locked up, I’ll just restore from backup and tell them to get lost.” It’s a good instinct. It’s also exactly the plan that a ransomware operation called Gunra is built to defeat — because Gunra doesn’t just lock up your files. It steals a copy first, and it goes hunting for your backups to destroy them. When your safety net is gone, “I’ll just restore” stops being an option.

Gunra is serious enough that the U.S. Cybersecurity and Infrastructure Security Agency, the FBI, and South Korean authorities issued a joint advisory about it. That’s a strong signal — these coordinated government warnings are reserved for threats actively causing real damage across borders. So let’s break down what Gunra is, how it gets in (there’s a clear, actionable lesson there), the three-part squeeze it puts on victims, and what actually protects a business from this kind of attack.

Why the backup angle is the whole story

Start with what makes this group genuinely dangerous, because it’s the part every business owner needs to feel in their gut. For years, the standard advice against ransomware was simple: keep good backups, and you can always recover without paying. Attackers adapted. Modern operations like Gunra now specifically seek out and destroy backups as part of the attack — encrypting or wiping the very databases, network storage, and backup systems you’d rely on to recover.

Think about what that does to your options. If your backups are intact, a ransomware attack is a bad day: you wipe the affected machines, restore, and move on without paying a cent. If your backups are gone, that same attack is an existential threat: the only remaining copy of your business’s data is the one the criminals are holding hostage. The entire game, from the attacker’s point of view, is to move you from the first situation to the second before you even know they’re there. Which is why this story isn’t really about encryption. It’s about whether your safety net survives.

The core truth about modern ransomware: a backup an attacker can reach and delete is not really a backup — it’s just a second copy waiting to be destroyed alongside the first. Real protection comes from backups the attacker cannot touch even after they’re inside your network: copies kept offline, or in storage that can’t be altered or erased once written. If your backup lives on the same network as everything else, quietly ask yourself whether it would survive an intruder who already has the run of the place.

How Gunra gets in: the door you can actually close

Here’s the most immediately useful part of the whole story. According to the advisory, Gunra’s operators get their initial foothold primarily by exploiting known vulnerabilities in internet-facing security appliances — specifically, flaws in certain firewall and VPN products (from Fortinet and Schneider Electric) that let an attacker bypass the login entirely.

Read that phrase carefully: known vulnerabilities. These aren’t secret, undiscovered flaws. They’re publicly documented weaknesses that the manufacturers have already released fixes for. The attackers are simply counting on the fact that many organizations haven’t installed those updates yet — and are walking in through the security devices that were supposed to be keeping them out. There’s a bitter irony there: the firewall and the VPN, the very equipment a business buys to be protected, becomes the way in when it isn’t kept up to date.

This is why we sound like a broken record about updates — and why the lesson lands differently when it’s your security appliance rather than your laptop:

• Your internet-facing devices are the highest-priority things to keep patched. Anything reachable from the internet — firewalls, VPN gateways, remote-access appliances — is exposed to constant automated probing. A known, unpatched flaw in one of these is one of the most direct paths into a business that exists.
• Someone needs to own this. In a business without dedicated IT, “make sure the firewall’s firmware is current” is a task that belongs to no one — which is precisely how devices end up years out of date. When a vendor releases a security fix for this kind of equipment, it needs to be applied quickly and deliberately, not eventually.
• Default and weak credentials compound it. Investigators noted some intrusions also involved security appliances left on default credentials with no protection against repeated login attempts. An unpatched device with an unchanged factory password is about as open as a door can be.

The three-part squeeze

Once inside, Gunra runs a playbook designed to leave victims with as few options as possible. It’s often called “double extortion,” but with the backup destruction it’s really a three-part squeeze:

Notice how this defeats the two obvious defenses at once. “I’ll restore from backup” is answered by step two. “Fine, I’ll take the hit and rebuild rather than pay” is answered by step three — because even if you recover your systems, they still have your data and can leak it, exposing your customers and creating legal and reputational fallout that a backup can’t fix. It’s engineered so that no single defense is enough on its own, which is the whole point of the next section.

A note on the ransomware business: Gunra reportedly operates as “ransomware-as-a-service” — the core group builds and rents out the attack tools to affiliates who carry out break-ins for a share of the profits, and has reportedly recruited penetration testers as paid intruders. We mention this because it reframes the threat. You’re likely not being targeted by a lone mastermind, but by one of many rented operators spraying the same known exploits at every unpatched device they can find. That’s daunting in its scale, but clarifying in its defense: patch the holes they rent access to exploit, and you fall off their easy-target list.

Who Gunra targets — and why “not us” is the wrong assumption

The advisory notes Gunra has hit organizations across many sectors and countries — healthcare, financial services, government, and nonprofit and professional services among them, on multiple continents. In other words, it is not narrowly focused on one industry or one region. Its “targeting” is, in large part, opportunistic: it goes after organizations running the vulnerable, unpatched equipment it knows how to exploit, wherever they happen to be.

That’s the key mental shift. Many small and mid-sized organizations assume they’re too small or too ordinary to attract a ransomware crew. But when the entry method is “scan the internet for known-vulnerable firewalls and walk through the ones nobody patched,” being small is no protection at all. You’re not selected for who you are; you’re selected for having left a known door unlocked. The good news buried in that: it means the same basic diligence that protects a large enterprise protects you too.

What actually protects you

Because Gunra is built to defeat any single defense, the protection is a small stack of habits that back each other up. None is exotic; together they’re formidable.

• Keep internet-facing equipment patched — urgently. This is the door Gunra walks through. When your firewall, VPN, or remote-access appliance has a security update available, applying it promptly closes the single most common entry point. Make it someone’s explicit job.
• Keep backups that an intruder cannot reach. This is what neutralizes their backup-destruction move. At least one copy of your critical data should be offline or in storage that can’t be altered or deleted once written — so it survives even an attacker who’s inside. And test that you can actually restore from it, before you need to.
• Change every default password and turn on multi-factor authentication. This shuts the secondary doors — the factory-set credentials and password-only logins that let attackers in even without an exploit.
• Segment your network. If an attacker does get a foothold, internal walls keep them from reaching everything — including your backups — at once. Contained damage is survivable damage.

Here’s the reassuring bottom line. Gunra is frightening, but it is not magic. It gets in through unpatched, internet-facing equipment — a door you can close. It defeats recovery by destroying reachable backups — a move you can neutralize with backups it can’t touch. Every part of its playbook has a specific, achievable counter. The organizations that fall to it are, overwhelmingly, the ones that left the known door open and kept their safety net where an intruder could cut it down.

Making sure your business isn’t one of them is exactly what our environment review is for. We check whether your internet-facing devices are current and properly configured, assess whether your backups would actually survive an attacker who’s already inside, and identify where a foothold in one place could spread to everything. Ransomware like Gunra is engineered to exploit exactly the gaps that go unnoticed in a busy business without dedicated IT. Finding and closing those gaps before an attack is the difference between a bad day you recover from and a disaster you might not. Let’s make sure your safety net is real.

Sources: Joint #StopRansomware advisory from CISA, the FBI, and Republic of Korea authorities (KNPA), August 2026; The Hacker News; The Register; Cyber Security News; Industrial Cyber; CyberInsider, August 2026. Specific vulnerability identifiers and technical indicators are omitted here in favor of awareness-level guidance; they are available in the government advisory for technical staff.