Agencies warn of attacks by Gunra ransomware

U.S. and international agencies released a joint cybersecurity advisory Aug. 10 warning of actions by Gunra ransomware. Gunra is a ransomware-as-a-service program that has been used to target government, critical infrastructure — including healthcare — and other organizations in the U.S. and abroad. Gunra actors leverage a double-extortion model, both encrypting data and threatening to publish stolen data to a dedicated leak site if a ransom is not paid. The ransomware variant initially appeared in 2025. The advisory provides details on Gunra activity and includes detection and mitigation guidance to protect organizations.

For more information on this or other cyber and risk issues, contact John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org, or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.