[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5hwQt8wwSv2s39rw_Ci4vtCK5cyvyk8njaMYsygy3bU":3,"$fyDAJpGoEA1mqR1-Dnhy77nkZpvswfCKOnnhuJA8uk1M":67},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":64,"created_at":65,"updated_at":66,"published_at":28},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","A joint Korean advisory finds the two shared a watering hole page, a Korean financial security software vulnerability, SSH key fingerprints and network infrastructure, but stops short of saying how they are related.","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[10,11,12,13,14,15],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","Ransomware","# AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'\n\n*A joint Korean advisory finds the two shared a watering hole page, a Korean financial security software vulnerability, SSH key fingerprints and network infrastructure, but stops short of saying how they are related.*\n\n**Tags:** `Gunra` `AhnLab ASEC` `Operation Double Barrel` `Watering hole` `Ransomware`\n\n> AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.\n\n---\n\n## Operation Double Barrel\n\nOn 30 July 2026 the AhnLab Security Intelligence Center (ASEC) published a joint cybersecurity advisory, \"Operation Double Barrel\", with four Republic of Korea bodies: the National Intelligence Service (NIS), the National Police Agency (NPA), the Korea Internet & Security Agency (KISA) and the Financial Security Institute (FSI).\n\nThe advisory covers a state-sponsored threat group, which it does not name, active from 2025 through the first half of 2026. The group exploited zero-day vulnerabilities in two Korean financial security products, referred to only as \"financial security software A\" and \"financial security software I\", and used compromised legitimate Korean websites as watering holes. ASEC says the abused websites belonged to media organisations, educational institutions, healthcare institutions and manufacturing companies.\n\nThe malware described in the advisory includes two backdoors, Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE), together with a privilege escalation tool and a dropper.\n\n## The link to Gunra\n\nASEC compared the state-sponsored group's intrusions with cases in which attackers ultimately deployed Gunra ransomware to encrypt files and steal sensitive data. It lists these overlaps:\n\n- the same watering hole page;\n- exploitation of the same vulnerability in financial security software A for initial access;\n- shared malware and malware characteristics;\n- the same SSH key fingerprint;\n- shared network infrastructure, including download and reverse tunnelling addresses;\n- similar anti-forensic techniques.\n\nASEC is careful about what this means. It says it cannot definitively determine the relationship between the two. On current information they appear to be separate threat actors with different ultimate objectives, but they may have shared certain techniques, tools and infrastructure, or collaborated to a limited extent during the attacks.\n\n## The Gunra ransomware group\n\nGunra is the subject of a separate joint #StopRansomware advisory, AA26-222A, published on 10 August 2026 by the FBI, CISA and partners including Korea's National Police Agency. According to that advisory, the FBI first observed Gunra in April 2025, the ransomware appears to be derived from the leaked Conti source code, and the group launched a formal ransomware-as-a-service affiliate programme in January 2026, at times operating under the name \"Golden Community\". It encrypts files with ChaCha20 and RSA-4096, appends the `.ENCRT` extension, and uses double extortion through a Tor-based negotiation portal and leak site.\n\n## Key points\n\n- ASEC, NIS, NPA, KISA and FSI published 'Operation Double Barrel' on 30 July 2026.\n- An unnamed state-sponsored group exploited zero-days in two Korean financial security products through watering hole attacks from 2025 into 2026.\n- Its tooling includes the Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE) backdoors.\n- Gunra intrusions shared the watering hole page, the financial security software A vulnerability, an SSH key fingerprint, infrastructure and anti-forensic techniques with the state-sponsored activity.\n- ASEC does not reach a firm conclusion: the two appear to be separate actors that may have shared tools and infrastructure or collaborated to a limited extent.\n\n## Further reading & sources\n\n- [[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)](https:\u002F\u002Fasec.ahnlab.com\u002Fen\u002F94696) (AhnLab Security Intelligence Center)\n- [#StopRansomware: Gunra Ransomware](https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa26-222a) (CISA)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5",{"iocs":19,"actors":23,"malware":35,"timeline":46,"technologies":58},[20],{"type":21,"value":22},"other",".ENCRT",[24,30],{"url":25,"name":10,"slug":26,"type":27,"origin":28,"motivation":29},"\u002Fthreat-groups\u002Fgunra","gunra","ransomware",null,"financial",{"url":31,"name":32,"slug":33,"type":27,"origin":34,"motivation":29},"\u002Fthreat-groups\u002Fconti","Conti","conti","Russia",[36,38,40,42,44],{"name":37},"Brandoor",{"name":39},"Privilege Escalation Tool",{"name":41},"Dropper",{"name":43},"Struggle",{"name":45},"Gunra Ransomware",[47,51,54],{"date":48,"event":49,"description":50},"2025-03","First seen","Gunra first emerged",{"date":52,"event":49,"description":53},"2025-04","Gunra first seen on Windows",{"date":55,"event":56,"description":57},"2026-03","Expansion","Gunra expanded operations with RaaS affiliate program",[59,62],{"vendor":60,"product":61},"Korean","Financial Security Software A",{"vendor":60,"product":63},"Financial Security Software I","threat_actor_activity","2026-09-18T07:15:06.272711+00:00","2026-10-16T12:28:32.96679+00:00",{"articles":68},[69,79,90,101],{"slug":70,"title":71,"summary":72,"tags":73,"hero_image_url":76,"story_type":77,"created_at":78},"cisa-issues-stopransomware-advisory-for-gunra-ransomware","CISA Issues #StopRansomware Advisory for Gunra Ransomware","On 10 August 2026 the FBI, CISA, DC3, NSA, the US Secret Service and the Republic of Korea's National Police Agency published #StopRansomware advisory AA26-222A on Gunra, a ransomware family first seen in April 2025 that launched a formal RaaS affiliate programme in January 2026 and uses ChaCha20 and RSA-4096 encryption with double extortion.",[74,10,15,13,14,75],"CISA","CVE-2024-55591","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-issues-stopransomware-advisory-for-gunra-ransomware.png?v=b7e6a015f5","ransomware_incident","2026-08-27T17:06:47.703652+00:00",{"slug":80,"title":81,"summary":82,"tags":83,"hero_image_url":88,"story_type":64,"created_at":89},"trend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a","Background: Trend Micro's 2025 Analysis of The Gentlemen Ransomware's Driver Abuse and Anti-AV Tools","In September 2025 Trend Micro published an analysis of The Gentlemen, then a previously undocumented ransomware group, describing a vulnerable-driver process killer, Group Policy abuse and attacks on manufacturing, construction, healthcare and insurance in at least 17 countries. This article summarises that research as background.",[84,15,85,86,87],"The Gentlemen","Trend Micro","Driver Abuse","Cybersecurity Threats","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a.png?v=fb82a8efc1","2026-08-18T18:29:37.334637+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":99,"story_type":77,"created_at":100},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor","Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.",[95,96,97,15,98],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":102,"title":103,"summary":104,"tags":105,"hero_image_url":110,"story_type":77,"created_at":111},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer","DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.",[106,15,107,108,109],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00"]