Skip to main content
TLP:GREEN  ·  States / Public Sector
Gunra Ransomware Targets State Government as CISA Issues Emergency Advisory:

What CISOs Must Do Now

ELEVATED. Unchanged from the prior cycle, but with increased pressure. CISA issued a #StopRansomware advisory for Gunra — a RaaS operation that explicitly targets regional and state government — on August 10. A second critical vulnerability in Progress Kemp LoadMaster (CVE-2026-8037, CVSS 9.6) is confirmed under active exploitation, and publicly available proof-of-concept code now enables attackers to silently crash Cisco ClamAV-based endpoint protection, creating a window for malware delivery.

I am a
My sector

DevelopmentDateSignificance
CISA #StopRansomware Advisory for Gunra (AA26-222a)Aug 10, 2026Highest-visibility federal ransomware alert; Gunra explicitly targets regional government
CVE-2026-8037 added to CISA KEVAug 7, 2026Second LoadMaster KEV in recent weeks; CVSS 9.6 pre-auth RCE; active exploitation confirmed
ClamAV DoS PoC published (CVE-2026-20337, CVE-2026-20338)Aug 7, 2026Crafted ZIP crashes endpoint AV, creating ransomware delivery window
HOOK SPIDER access broker profile updatedAug 11, 2026Confirmed facilitating ransomware operations against US government targets
Windows PnP → SYSTEM escalation disclosed (DEF CON 34)Aug 11, 2026Relevant to state RDP/VDI environments with PnP redirection enabled
Nation-state pre-positioning confirmed; MuddyWater (MOIS) ICS/OT campaign activeAug 1–Jul 25, 2026Volt Typhoon/Salt Typhoon in state networks; Iranian MOIS targeting water/wastewater PLCs across 7+ states

DateEventImpact to State Government
Jul 25, 2026Salt Typhoon & Volt Typhoon confirmed pre-positioned in U.S. state networksNation-state persistence in government infrastructure
Aug 1, 2026MuddyWater (Iranian MOIS) targeting water/wastewater PLCs across 7+ statesDirect ICS/OT threat to state-regulated critical infrastructure
Aug 5, 2026Gunra ransomware last confirmed victim (51 total to date)Active operations continuing
Aug 7, 2026CVE-2026-8037 (LoadMaster CVSS 9.6) added to CISA KEVState citizen-facing portals at risk; federal remediation deadline Aug 10
Aug 7, 2026ClamAV CVE-2026-20337/20338 disclosed with PoCCisco Secure Endpoint deployments vulnerable to silent bypass
Aug 10, 2026CISA issues #StopRansomware advisory for GunraFederal confirmation of elevated ransomware threat to government
Aug 11, 2026HOOK SPIDER access broker updated — US government targeting confirmedCredential theft today becomes ransomware tomorrow

Gunra is a Conti-lineage RaaS operation that emerged in April 2025 and has claimed 51 victims across 16 months. What distinguishes Gunra from the broader ransomware ecosystem is its explicit targeting of regional government — confirmed by Intel 471 classification and now elevated by CISA's #StopRansomware designation, which is reserved for the most operationally impactful ransomware threats.

Key characteristics: initial access via Fortinet and Schneider Electric vulnerabilities; double-extortion model (data theft + encryption); top targeted sectors include Manufacturing, Healthcare, Professional Services, Technology, Financial Services, and Government; geographic focus: United States, Canada, UK, Germany, Australia. Access facilitation via HOOK SPIDER access broker (aliases: crasty_bro, pirat, BenjaminFranklin), which sells credentials and VPN/RDP access to Gunra affiliates.

The access broker pipeline is critical to understand. HOOK SPIDER uses infostealers — specifically RedLine Stealer and Vidar Stealer — to harvest credentials from government employees. These credentials are packaged and sold to ransomware affiliates. HOOK SPIDER is confirmed to facilitate operations for SCATTERED SPIDER, VICE SPIDER, ALPHA SPIDER, WANDERING SPIDER, and Nova RaaS in addition to Gunra's affiliate ecosystem. A single compromised credential can lead to full network encryption within days.

T1589.001

Progress Kemp LoadMaster — widely deployed for load balancing citizen-facing government portals — now has its second critical vulnerability added to CISA's KEV catalog in recent weeks. CVE-2026-8037 is a pre-authentication OS command injection vulnerability scoring CVSS 9.6. WatchTowr Labs published a full proof-of-concept, and eSentire has confirmed active targeting in the wild.

For state agencies running LoadMaster in front of tax portals, benefits systems, DMV services, or other citizen-facing applications, this is an emergency. An attacker exploiting this vulnerability gains code execution on the load balancer itself — a position that enables traffic interception, lateral movement into backend systems, and potential manipulation of citizen-facing services.

T1190

CVE-2026-20337 and CVE-2026-20338 are high-severity (CVSS 7.5) vulnerabilities in ClamAV's ZIP file parser. A crafted ZIP file — delivered via email, file share, or web download — can crash the ClamAV scanning process. For agencies running Cisco Secure Endpoint (which uses ClamAV), this means: the attacker sends a crafted ZIP to the target; ClamAV crashes silently with no alert generated; subsequent malware payloads arrive while scanning is disabled; ransomware deploys without endpoint detection.

This is a pre-ransomware enabler technique. ZIP files are ubiquitous in government email workflows. The crash is silent. The window of vulnerability persists until the ClamAV process restarts. PoC exploit code is publicly available.

T1562.001

While no new Volt Typhoon or Salt Typhoon indicators were detected this cycle, these actors remain confirmed pre-positioned in U.S. state and National Guard networks as of July 25, 2026. Chinese state-sponsored actors including TEMP.Overboard (BlackTech), Granite Typhoon (UNC2814), and APT27 (UNC251) all show recent activity updates in threat intelligence feeds. MuddyWater (Iranian MOIS) continues its ICS/OT campaign against water and wastewater systems across 7+ states.

The absence of new indicators during a period of degraded intelligence collection is not reassurance — it is a blind spot that demands proactive hunting.

ScenarioProbabilityTimeframeBasis
Gunra affiliates attempt exploitation of unpatched Fortinet appliances in US government networks75% (HIGH)7 daysCISA advisory creates awareness but also signals target-rich environment to affiliates
ClamAV PoC weaponized into email-borne attack chain50% (MODERATE)14 daysPublic PoC availability + high utility as ransomware precursor
HOOK SPIDER lists new US government network access for sale35% (LOW-MODERATE)7 daysActor profile updated Aug 11; historically active against US government
Unpatched LoadMaster instances exploited for initial access to state networks70% (HIGH)7 daysActive exploitation confirmed; PoC public; second KEV indicates sustained attacker interest
Volt Typhoon activates pre-positioned access in state infrastructure15% (LOW)30 daysPre-positioning confirmed but activation tied to geopolitical triggers

PriorityWhat to MonitorATT&CK TechniqueDetection Logic
CRITICALClamAV/clamd process crashesT1562.001 (Disable or Modify Tools)Alert on unexpected termination of clamd/freshclam processes. A crash followed by inbound ZIP attachment delivery is a HIGH-fidelity ransomware precursor.
CRITICALLoadMaster management interface accessT1190 (Exploit Public-Facing Application)Monitor for anomalous API calls to LoadMaster; alert on command injection patterns in request parameters
HIGHFortinet appliance exploitation attemptsT1190 (Exploit Public-Facing Application)Correlate with Gunra-associated CVEs per CISA AA26-222a
HIGHInfostealer beaconing (RedLine, Vidar)T1589.001 (Gather Victim Identity Information)Monitor for known C2 patterns; credential dump detection on endpoints
MODERATERDP PnP device redirection eventsT1021.001 (Remote Desktop Protocol)Alert on USB device enumeration over RDP sessions; audit PnP redirection GPO settings
MODERATETor/onion domain resolution attemptsT1090.003 (Multi-hop Proxy)Block and alert on DNS queries matching .onion patterns (Gunra leak site communication)
Hunting Hypotheses:
HUNT 01 · T1589.001
HOOK SPIDER has already harvested credentials from state agency employees
Query dark web monitoring for state agency domain credentials; review authentication logs for impossible travel or anomalous login patterns from known infostealer C2 geographies.
HUNT 02 · T1190
LoadMaster appliances have been probed or exploited since the CVE-2026-8037 PoC publication
Review LoadMaster access logs for the past 14 days; search for command injection patterns in API request parameters; check for unauthorized configuration changes.
HUNT 03 · T1562.001
ClamAV has already been crashed on endpoints via crafted ZIP delivery
Correlate ClamAV process restart events with inbound email attachments containing ZIP files; identify endpoints where ClamAV uptime is anomalously short.
HUNT 04 · T1059.001
Volt Typhoon living-off-the-land activity persists in state networks
Baseline ntdsutil, netsh, wmic, and PowerShell usage patterns; alert on execution from unexpected user contexts or at unusual times.

Financial Services
State Treasury, Revenue, Benefits Systems
Primary threat
Gunra double-extortion targeting financial data; HOOK SPIDER credential theft from payroll/benefits portals.
Secondary threat
Citizen tax records and benefits data are high-value extortion targets.
Actions
  • Verify Fortinet appliance patch status protecting revenue systems
  • Implement MFA enforcement on all financial system access
  • Deploy infostealer detection (RedLine/Vidar signatures) on endpoints accessing financial applications
Energy
State-Regulated Utilities, PUC Oversight
Primary threat
MuddyWater (Iranian MOIS) ICS/OT campaign against water/wastewater PLCs; Volt Typhoon pre-positioning in energy infrastructure.
Secondary threat
Disruption of state-regulated utility operations; safety system manipulation.
Actions
  • Validate network segmentation between IT and OT environments
  • Audit remote access to SCADA/HMI systems (ABB Zenon)
  • Implement allowlisting on OT workstations
Healthcare
State Health Agencies, Medicaid Systems
Primary threat
Gunra has 8 confirmed healthcare victims; ransomware targeting health data for double-extortion.
Secondary threat
HIPAA breach notification obligations compound ransomware impact.
Actions
  • Ensure Cisco Secure Endpoint is updated to ClamAV 1.5.4 on systems processing PHI
  • Verify backup integrity for Medicaid/health information systems
  • Test incident response playbooks for healthcare data breach notification requirements
Government
Executive Branch Agencies, Shared Services
Primary threat
Gunra explicitly targets regional government; HOOK SPIDER sells government network access; LoadMaster exploitation threatens citizen-facing portals.
Secondary threat
Citizen PII exposure (SSN, DMV, tax records) creates legal liability and public trust damage.
Actions
  • Emergency LoadMaster patching
  • Agency-wide RDP configuration audit (disable PnP redirection)
  • Deploy ClamAV crash monitoring across all endpoints; validate credential hygiene (password reuse detection)
Aviation / Logistics
State DOT, Airport Authorities
Primary threat
Supply chain and logistics software risks; ransomware disruption of transportation management systems; potential lateral movement from IT into operational technology environments.
Secondary threat
Transportation system disruption affecting state operations and public safety.
Actions
  • Validate network segmentation for transportation management systems
  • Audit third-party logistics vendor access
  • Ensure LoadMaster patching extends to any DOT-managed load balancing infrastructure

Patch all Progress Kemp LoadMaster appliances to June 2026+ firmware (CVE-2026-8037). CVSS 9.6, CISA KEV, active exploitation confirmed, PoC public.
Incident Responder
Deploy ClamAV process crash monitoring on all Cisco Secure Endpoint hosts. Silent AV bypass enables ransomware delivery; crash + ZIP is a high-fidelity alert.
SOC Analyst
Verify no LoadMaster management interfaces are internet-exposed. Management interface exposure is a direct RCE path.
Incident Responder
Brief executive leadership on the Gunra ransomware threat and required decisions. The CISA advisory creates urgency; patching windows and budget may require executive approval.
CISO / Exec
No immediate actions for the selected roles.
Update Cisco Secure Endpoint Connector to ClamAV 1.5.4 (all Windows endpoints first). CVE-2026-20337/20338 PoC is public; Windows is highest risk due to privileged context.
Incident Responder
Create detection rules for Gunra indicators; block onion resolution; alert on Fortinet exploitation patterns. CISA AA26-222a provides actionable indicators.
SOC Analyst
Audit RDP/VDI configurations agency-wide — disable PnP device redirection and RemoteFX USB redirection. DEF CON research demonstrates SYSTEM escalation via PnP over RDP.
Incident Responder
Validate dark web monitoring coverage for state agency domain credentials. HOOK SPIDER uses infostealers; credential sales precede ransomware by days to weeks.
Threat Hunter
Test the ransomware incident response playbook with a Gunra-specific scenario. Validate notification timelines, backup restoration procedures, and communication plans.
Incident Responder
No 7-day actions for the selected roles.
Commission an inventory assessment of all Fortinet and Schneider Electric appliances against Gunra exploitation targets. Gunra uses these vendors for initial access; the state must know its exposure.
CISO / Exec
Deploy YARA rules for RedLine Stealer and Vidar Stealer across the endpoint fleet. Access broker detection is upstream of ransomware; earlier detection means prevented encryption.
SOC Analyst
Implement a secondary OSINT collection source for threat intelligence operations. Single-source dependency has created blind spots across legislation, nation-state, and cloud threat coverage.
Threat Hunter
Conduct a Volt Typhoon living-off-the-land hunt across state network telemetry. Chinese APT pre-positioning confirmed Jul 25; absence of new indicators during collection degradation demands proactive validation.
Threat Hunter
Evaluate defense-in-depth for endpoint security bypass scenarios. If ClamAV crashes, secondary detection (EDR behavioral, network sandbox) must compensate; single-layer AV is insufficient.
CISO / Exec
Confirm ransomware insurance coverage and notification obligations. Gunra's double-extortion model means data is exfiltrated before encryption; breach notification may be required regardless of recovery success.
CISO / Exec
Validate backup integrity and restoration timelines. Can critical citizen services be restored within acceptable RTO if ransomware deploys?
CISO / Exec
No 30-day actions for the selected roles.
The Bottom Line

The convergence of a CISA #StopRansomware advisory naming a group that deliberately targets state government, a second critical KEV for perimeter load balancers common in government infrastructure, and publicly available exploit code to silently disable endpoint protection creates a threat window that demands immediate action. The kill chain is clear: infostealers harvest credentials, access brokers sell government network access, ransomware affiliates exploit unpatched perimeter devices, endpoint security is bypassed, and citizen data is stolen and systems are encrypted. Every link in this chain has a corresponding defensive action. The question is whether those actions are taken before or after the incident.

1
Patch LoadMaster today.
2
Monitor ClamAV crashes today.
3
Audit your RDP configurations this week. Hunt for credential compromise this month. The adversary's timeline is measured in days, not quarters.
No items found.