Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
2 matching stories
GunraAhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'
AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.
CISA Issues #StopRansomware Advisory for Gunra Ransomware
CISA has published a #StopRansomware advisory for the Gunra ransomware-as-a-service family, which first appeared in April 2025 and launched its formal RaaS affiliate program in January 2026, using a double-extortion model with a dedicated leak site and ChaCha20+RSA-4096 encryption on Windows and Linux.
