Threat Actor Activity18 Sept 2026·4 sources
AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'
AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.
GunraAhnLab ASECOperation Double Barrel+3
