A growing ransomware operation is putting hospitals, healthcare providers and other critical infrastructure organizations on alert after U.S. and international cybersecurity agencies warned about attacks involving Gunra ransomware.
Gunra has been linked to attacks across healthcare, government, financial services, manufacturing and other critical sectors. The latest warning highlights a combination of known software vulnerabilities, stolen credentials, data theft and system encryption that can leave organizations facing both operational disruption and the threat of sensitive information being exposed.
The warning is particularly significant for healthcare organizations, where a ransomware attack can disrupt patient care while also creating serious privacy and regulatory concerns.
How Gunra Became a Growing Threat
Gunra first appeared in April 2025 and later developed into a ransomware-as-a-service operation. This model allows affiliates to use ransomware infrastructure and tools to conduct their own attacks, making it easier for the operation to expand.
Gunra has reportedly targeted organizations across North America, Europe, Asia-Pacific and other regions. Healthcare and public health are among the sectors identified as targets.
The operation has also been associated with code derived from leaked Conti ransomware source code. That connection does not mean Gunra is operated by the former Conti group, but it demonstrates how leaked ransomware technology can continue to influence newer criminal operations.
Fortinet Vulnerabilities Are a Major Concern
One of the most important findings in the latest warning is Gunra’s exploitation of two known Fortinet vulnerabilities: CVE-2024-55591 and CVE-2025-24472.
The vulnerabilities affect FortiOS and FortiProxy products and can potentially provide attackers with administrative access to vulnerable systems.
For healthcare organizations, this is particularly concerning because firewalls and VPN appliances sit at the edge of corporate networks. Once compromised, they can provide attackers with a pathway into systems containing patient information and other critical resources.
Organizations using affected Fortinet products should therefore confirm that security updates have been applied and that exposed management interfaces are properly protected.
Gunra Combines Data Theft With Encryption
Gunra follows the double-extortion model.
Attackers can first steal information and then encrypt systems, giving them two ways to pressure victims. Even if a hospital has reliable backups and can restore its systems, stolen information can still be used to threaten the organization with public disclosure.
For healthcare providers, the potential impact can include patient-data exposure, operational disruption, financial losses, reputational damage and regulatory investigations.
The federal warning indicates that victims may receive only a short period to respond before attackers threaten to publish stolen information.
Attackers Can Spend Time Inside a Network
Ransomware attacks do not always begin with immediate encryption.
Gunra operators have been observed using legitimate administrative tools to move through compromised environments, obtain credentials and identify valuable systems.
They have also used techniques intended to make investigations more difficult, including deleting logs and command histories.
This creates an important opportunity for defenders. Detecting unusual activity before ransomware deployment can allow security teams to isolate compromised systems and potentially prevent a much larger incident.
Cloud Accounts Are Part of the Attack Surface
Gunra activity has also involved enterprise cloud environments, including Microsoft OneDrive and SharePoint.
This highlights an important change in ransomware defense. Protecting servers inside a hospital is no longer enough.
Security teams also need visibility into cloud accounts, identity systems, remote-access platforms and collaboration services.
A stolen administrator credential can provide attackers with access to large amounts of information without requiring them to compromise every individual device.
Healthcare Is Already Facing Heavy Ransomware Pressure
The Gunra warning arrives during a period of continued ransomware activity against healthcare.
Other ransomware operations, including Medusa, have also been the subject of recent federal warnings. Large healthcare breaches and disruptions continue to demonstrate how attractive the sector is to cybercriminals.
Healthcare organizations are particularly appealing because they maintain valuable information while operating systems that often cannot simply be taken offline.
An attack affecting electronic health records, laboratory systems, imaging platforms or communications can quickly become an operational problem rather than an ordinary IT incident.
Recent Incidents Show the Broader Risk
The Gunra threat also comes against the backdrop of several significant healthcare cybersecurity incidents.
In August 2026, healthcare technology company CareCloud disclosed that a cyberattack had affected more than 3.7 million individuals. The incident involved unauthorized access to an AWS environment and demonstrated the scale of exposure that can result when large healthcare datasets are compromised.
The incident was not attributed to Gunra, but it illustrates the broader challenge facing healthcare organizations: attackers do not need to deploy ransomware to cause serious damage. Data theft alone can have major consequences.
What Gunra Means for HIPAA Compliance
A ransomware incident involving a healthcare organization can quickly become a HIPAA compliance issue.
Organizations need to determine whether protected health information was accessed or acquired by unauthorized individuals. Simply restoring encrypted systems does not necessarily resolve the privacy implications of an attack.
Healthcare providers should preserve forensic evidence, investigate potential data exfiltration and conduct an appropriate breach-risk assessment.
Incident-response plans should therefore involve cybersecurity, privacy, legal and compliance teams rather than leaving ransomware response entirely to IT staff.
The Most Important Defensive Measures
The fundamentals remain among the most effective defenses against Gunra and similar ransomware operations.
| Priority | Recommended action |
| Patch management | Patch affected Fortinet systems and other exposed software |
| Remote access | Review VPN and administrative access |
| Authentication | Require multifactor authentication |
| Network security | Segment critical clinical and administrative systems |
| Backups | Maintain isolated or immutable backups |
| Monitoring | Watch for unusual logins and data transfers |
| Incident response | Regularly test ransomware response procedures |
Organizations should also review privileged accounts, remove unnecessary access and ensure that security logs cannot easily be erased by compromised administrators.
Backups Cannot Solve Everything
Backups remain essential, but modern ransomware attacks have changed how organizations should think about recovery.
A clean backup can help restore encrypted systems. It cannot undo data that attackers have already copied.
Healthcare organizations therefore need to prepare for two separate problems: restoring operations and responding to potential information theft.
Backup systems should be isolated from production environments and regularly tested to confirm that critical systems can actually be restored.
A Potential Weakness in Gunra’s Linux Variant
Security researchers have identified a weakness in the Linux version of Gunra that could potentially assist with recovering encryption keys using file timestamps.
The weakness does not apply to every Gunra attack, particularly because the Windows variant uses a different encryption implementation.
Organizations affected by Gunra should therefore preserve encrypted systems and forensic evidence rather than assuming that recovery is either impossible or guaranteed.
What Healthcare Organizations Should Do Now
To stay ahead of the Gunra ransomware threat, healthcare organizations should focus on a few key areas:
Patch first
Check Fortinet FortiOS and FortiProxy devices for the vulnerabilities linked to Gunra activity and apply the appropriate security updates.
Close remote-access gaps
Review VPNs, remote-access services and exposed administrative interfaces. Remove unnecessary internet access and tighten controls around external connections.
Harden user access
Require multifactor authentication for remote, privileged and administrative accounts, while regularly reviewing who has elevated access.
Contain the blast radius
Segment patient records, clinical systems, backup infrastructure and other critical resources so that a compromised device cannot easily reach the wider environment.
Keep an eye on the cloud
Monitor Microsoft 365, OneDrive and SharePoint for unusual logins, unexpected privilege changes and large or unexplained data transfers.
Make recovery harder to disrupt
Maintain isolated or immutable backups and regularly test restoration procedures instead of assuming backups will work when an incident occurs.
Prepare for stolen data
Response plans should account for more than encrypted systems. Teams should also be ready to investigate potential data exfiltration and assess any resulting HIPAA obligations.
Practice before an attack happens
Cybersecurity, IT, privacy, legal and compliance teams should know their roles before a ransomware incident occurs, reducing delays when every minute matters.
Gunra Ransomware: Key Questions Answered
Is Gunra ransomware targeting healthcare?
Yes. Healthcare and public health organizations are among the sectors identified in the recent federal warning.
What Fortinet vulnerabilities are involved?
Gunra affiliates have been associated with exploitation of CVE-2024-55591 and CVE-2025-24472 affecting FortiOS and FortiProxy.
Does Gunra steal data?
Yes. Gunra uses double extortion, combining data theft with system encryption and threats to release stolen information.
Can backups protect against Gunra?
Backups can help organizations recover encrypted systems, but they cannot prevent attackers from exposing information that has already been stolen.
What should hospitals do first?
They should check vulnerable internet-facing systems, apply available patches, secure remote access, enforce multifactor authentication and verify that isolated backups are available.
The Bigger Lesson for Healthcare
Gunra demonstrates that ransomware groups do not necessarily need sophisticated zero-day attacks to cause serious damage. Known vulnerabilities, stolen credentials and weakly protected remote-access systems can provide enough opportunity for attackers to penetrate complex healthcare environments.
For hospitals and healthcare providers, the priority should be straightforward: patch exposed systems, strengthen identity controls, segment critical networks, protect backups and prepare to investigate data theft as seriously as encryption.
Gunra may continue to evolve, but the underlying lesson remains the same. The strongest defense is an environment where compromising one device, account or network appliance does not give attackers a clear path to the systems supporting patient care.
