Operation Double Barrel
On 30 July 2026 the AhnLab Security Intelligence Center (ASEC) published a joint cybersecurity advisory, "Operation Double Barrel", with four Republic of Korea bodies: the National Intelligence Service (NIS), the National Police Agency (NPA), the Korea Internet & Security Agency (KISA) and the Financial Security Institute (FSI).
The advisory covers a state-sponsored threat group, which it does not name, active from 2025 through the first half of 2026. The group exploited zero-day vulnerabilities in two Korean financial security products, referred to only as "financial security software A" and "financial security software I", and used compromised legitimate Korean websites as watering holes. ASEC says the abused websites belonged to media organisations, educational institutions, healthcare institutions and manufacturing companies.
The malware described in the advisory includes two backdoors, Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE), together with a privilege escalation tool and a dropper.
The link to Gunra
ASEC compared the state-sponsored group's intrusions with cases in which attackers ultimately deployed Gunra ransomware to encrypt files and steal sensitive data. It lists these overlaps:
- the same watering hole page;
- exploitation of the same vulnerability in financial security software A for initial access;
- shared malware and malware characteristics;
- the same SSH key fingerprint;
- shared network infrastructure, including download and reverse tunnelling addresses;
- similar anti-forensic techniques.
ASEC is careful about what this means. It says it cannot definitively determine the relationship between the two. On current information they appear to be separate threat actors with different ultimate objectives, but they may have shared certain techniques, tools and infrastructure, or collaborated to a limited extent during the attacks.
The Gunra ransomware group
Gunra is the subject of a separate joint #StopRansomware advisory, AA26-222A, published on 10 August 2026 by the FBI, CISA and partners including Korea's National Police Agency. According to that advisory, the FBI first observed Gunra in April 2025, the ransomware appears to be derived from the leaked Conti source code, and the group launched a formal ransomware-as-a-service affiliate programme in January 2026, at times operating under the name "Golden Community". It encrypts files with ChaCha20 and RSA-4096, appends the .ENCRT extension, and uses double extortion through a Tor-based negotiation portal and leak site.
Key points
- ASEC, NIS, NPA, KISA and FSI published 'Operation Double Barrel' on 30 July 2026.
- An unnamed state-sponsored group exploited zero-days in two Korean financial security products through watering hole attacks from 2025 into 2026.
- Its tooling includes the Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE) backdoors.
- Gunra intrusions shared the watering hole page, the financial security software A vulnerability, an SSH key fingerprint, infrastructure and anti-forensic techniques with the state-sponsored activity.
- ASEC does not reach a firm conclusion: the two appear to be separate actors that may have shared tools and infrastructure or collaborated to a limited extent.
Further reading & sources
- [Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group) (AhnLab Security Intelligence Center)
- #StopRansomware: Gunra Ransomware (CISA)