Threat Intel
CISA, FBI Warn of Gunra Ransomware Surge Targeting Critical Infrastructure
CISA and the FBI alert that the Gunra ransomware gang is ramping up attacks across healthcare, energy, manufacturing, transportation, finance, and federal agencies. Using spear‑phishing, compromised vendor portals, and vulnerable remote‑desktop protocols, Gunra encrypts data and exfiltrates it before demanding ransom. The agencies urge immediate patching, MFA, offline backups, and incident reporting to mitigate the threat.
In a joint statement, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have warned that the Gunra ransomware gang is intensifying attacks across a broad swath of critical infrastructure.
What the attackers are doing
- Targeting sectors such as healthcare, energy, manufacturing, transportation, finance, and federal agencies.
- Deploying malware via spear‑phishing, compromised vendor portals, and vulnerable remote‑desktop protocols.
- Encrypting files and exfiltrating data before demanding a ransom, a classic double‑extortion strategy.
- Using the “Gunra” ransomware strain, which has been observed encrypting up to 1,200 files per infection.
Why it matters
Disruption in these industries can have ripple effects on public safety, national security, and the economy. The attackers have already crippled several hospitals and a state agency, forcing costly downtime and data loss.
Recommended defenses
- Validate and patch all software, especially remote‑desktop and VPN endpoints.
- Enforce multi‑factor authentication and least‑privilege access controls.
- Maintain up‑to‑date, offline backups and test recovery procedures.
- Monitor network traffic for anomalous data exfiltration and file‑encryption activity.
- Educate staff on spear‑phishing and social‑engineering tactics.
“We urge all organizations in the affected sectors to act swiftly and share any indicators of compromise with CISA’s Cybersecurity Response Center,” the agencies said.
For more guidance, visit the CISA website or contact the FBI’s Cyber Division.
Related articles
Russian State‑Supported Threat Targets Zimbra Collaboration Suite – CISA, NSA, FBI Alert
Security agencies CISA, NSA and FBI have jointly warned that Russian state‑supported actors are actively targeting Zimbra Collaboration Suite. The threat uses a mix of known CVEs, malicious attachments and drive‑by downloads to compromise Zimbra servers, exfiltrate data and pivot into corporate networks. Organizations running Zimbra must patch, harden and monitor for signs of compromise.
Read briefing
US Agencies Accuse Chinese AI Firms of Large‑Scale Distillation of U.S. LLMs
The FBI, NSA and CISA jointly warned that a group of Chinese startups—Alibaba, DeepSeek, MiniMax, Moonshot AI, StepFun and Z.AI—have been quietly harvesting billions of tokens from leading U.S. language models such as GPT, Claude, Gemini and Grok. Using industrial‑scale distillation tactics, the firms allegedly bypassed terms of service, leveraged premium API plans, and routed requests through opaque proxies to avoid detection. The move is said to slash development time and costs for Chinese competitors while potentially compromising U.S. intellectual property.
Read briefing
Cyber Storm X Marks Two Decades of National Cyber Readiness
CISA’s biennial Cyber Storm exercise hits its 20th year, drawing 2,000 participants from every corner of critical infrastructure. The 2026 drill simulates real‑world attacks on food, energy, and communications systems, sharpening response plans and cross‑sector teamwork.
Read briefing
AI‑Enabled Attacks: The Open Letter That Left Out Who’s Behind the Threat
A recent open letter from major tech firms warned that AI could make sophisticated cyberattacks cheaper and more common, but it failed to identify the actors exploiting the new tools or how to close the emerging threat window. The warning came after U.S. agencies uncovered AI‑generated exploitation scripts targeting exposed Siemens S7 PLCs in critical infrastructure. Analysts argue that criminals are driven by profit, not novelty, and that the real risk lies in old misconfigurations now being weaponized by AI. The industry must prioritize hardening high‑risk assets, scrutinize AI‑generated cod
Read briefing