Key takeaways
- On August 10, 2026, the FBI, CISA, NSA, and partners including South Korea’s National Police Agency published a joint advisory on Gunra, a double-extortion ransomware operation active against healthcare, financial services, manufacturing, transportation, government, and utilities.
- The reported entry point is perimeter plumbing: Fortinet vulnerabilities CVE-2024-55591 and CVE-2025-24472. But the money is made at the data layer, where actors use Impacket’s psexec.py and smbclient.py to move laterally and pull files over SMB.
- Gunra steals business documents, databases, PII, and internal email before encrypting, then pressures victims through a Tor leak site. Backups address the encryption half of that model and nothing else.
- Every step after initial access is file activity a behavior-aware storage platform can see: credentialed sessions reading at bulk, then mass change as encryption begins. That is the window where NAS ransomware protection either works or does not exist.
On August 10, 2026, the FBI, CISA, NSA, the Department of Defense Cyber Crime Center, the U.S. Secret Service, and South Korea’s National Police Agency released a joint #StopRansomware advisory on Gunra, a ransomware operation that emerged in April 2025 and, according to the advisory and public reporting from The Record and ITPro, has hit organizations across the Americas, Europe, the Middle East, Africa, and Asia-Pacific. The victim list spans healthcare, financial services, manufacturing, transportation, government, and utilities: the sectors where unstructured file data is both the crown jewels and the least-watched asset.
Gunra is reportedly built on leaked Conti source code and moved to a ransomware-as-a-service model in early 2026, recruiting affiliates and initial access brokers. Reported ransom demands frequently exceed $10 million, with five-to-seven-day deadlines and pressure applied through a Tor-based negotiation portal, a dedicated leak site, and emails sent directly to victim executives. Six agencies do not co-sign an advisory for a niche threat. They do it when the playbook is working at scale.
The break-in is a CVE. The theft is SMB.
According to the advisory, Gunra actors gain initial access by exploiting known vulnerabilities in internet-facing firewall and VPN appliances, specifically CVE-2024-55591 and CVE-2025-24472 in Fortinet products. Patch guidance follows, as it should. But the entry vector is the least distinctive part of the operation. Next quarter it will be a different appliance and a different CVE.
What happens after access is the durable pattern. The advisory documents lateral movement using Impacket’s psexec.py and smbclient.py: standard tooling that speaks the same SMB protocol every Windows file server and NAS in the enterprise speaks. From the storage system’s perspective, the actor is simply another authenticated session, browsing shares and reading files. The advisory says Gunra collects business-critical documents, databases, personally identifiable information, and internal email before any encryption begins. That is a sustained, credentialed bulk read of unstructured data, conducted with tools designed to look routine.
What NAS ransomware protection actually requires
NAS ransomware protection means the storage system itself can recognize and stop hostile file activity, rather than trusting that every authenticated session is friendly. Gunra’s post-access playbook is two behaviors in sequence: bulk reads while data is staged for exfiltration, then mass change as encryption sweeps the shares. Both are visible only at the point where file operations are served, across every protocol in use: SMB, NFS, S3, and Web Drive. A platform that profiles normal access per user, host, and dataset can flag a session that suddenly reads thousands of unrelated files or begins rewriting them wholesale, and terminate it mid-attack. Upstream controls cannot do this; endpoint agents do not run on the storage array, and network tools see encrypted SMB traffic, not the file operations inside it.
Least privilege matters for the same reason. An affiliate who compromises one account should not be able to traverse every share that account can technically reach. Attribute-based access control enforced at the file level shrinks the blast radius of any single credential, which is precisely the resource Gunra’s access brokers are selling.
Backups solve half of a double-extortion problem
The advisory’s core mitigations, patching known exploited vulnerabilities, maintaining offline immutable backups, and segmenting networks, are sound and worth doing. It is still worth being precise about what they cover. Backups restore encrypted data. They do not detect the weeks of reading that came first, and they do not retrieve files already published to a leak site. In a model where the data theft happens before the encryption, recovery-only defenses concede the first half of the attack by design.
Immutable snapshots and a per-operation audit trail close the rest of the gap on the recovery side: snapshots enable surgical rollback of exactly the files that changed, and the audit record turns "what did they touch?" from an estimate into an answer, which is the difference between a scoped disclosure and a worst-case one. But the architectural lesson of this advisory is about detection. Gunra’s entire post-access operation is file activity on live production storage. Any of these victims could be any organization running flat, trusting file shares behind a patched-or-not perimeter. The defense that changes the outcome is the one watching the data itself.
Frequently asked questions
- According to the joint FBI/CISA advisory, Gunra actors exploit internet-facing Fortinet vulnerabilities (CVE-2024-55591 and CVE-2025-24472) for initial access, then move laterally with Impacket’s psexec.py and smbclient.py over SMB. To a file server or NAS, this traffic looks like an ordinary authenticated session reading shares, which is why perimeter and endpoint tools routinely miss the staging and exfiltration phase.
- NAS ransomware protection is the ability of the storage platform itself to detect and stop ransomware behavior in real time: recognizing bulk reads that indicate data staging, mass file changes that indicate encryption in progress, and out-of-pattern access by compromised credentials, then terminating the session. It combines behavioral detection at the file-operation level, attribute-based access control for least privilege, immutable snapshots for surgical recovery, and a tamper-proof audit trail for scoping. It differs from backup, which recovers data after the fact but detects nothing.
- Only partially. Backups and immutable vaults address the encryption half: they let you restore locked files without paying. They do nothing about the theft half. Gunra exfiltrates documents, databases, and email before encrypting, and no restore operation removes stolen files from a leak site. Defending against double extortion requires detecting and stopping the bulk-read exfiltration phase while it is happening, at the storage layer.
Go deeper