Joint warnings from U.S. federal agencies and South Korea's National Police Agency have put government and critical infrastructure operators worldwide on notice: the Gunra ransomware operation is actively conducting encryption-based attacks against public sector and critical infrastructure organizations. When two national governments co-issue a warning like this, it signals observed, repeatable intrusions — not theoretical risk.
If you operate in government, healthcare, utilities, transportation, or any sector designated as critical infrastructure, treat this as an active threat to your environment now. The window between initial access and mass encryption in modern ransomware operations is often measured in hours, not weeks. This post breaks down what defenders need to know, how to detect Gunra-style activity before encryption completes, and the hardening steps that materially reduce your exposure.
Technical Analysis
Who Is Being Targeted
The joint advisory explicitly names government agencies and critical infrastructure organizations as the primary targets. This is consistent with the broader 2025–2026 ransomware trend of operators prioritizing public-sector victims: they hold sensitive data, face enormous operational pressure to restore services, and historically have been more likely to pay.
How These Attacks Typically Unfold (Defender's View)
While specific intrusion vectors vary by victim, Gunra's encryption-based campaigns follow the established ransomware playbook that defenders must instrument against:
- Initial Access — Exploitation of internet-facing services (unpatched VPN appliances, RDP, exposed remote management), phishing with malicious attachments or links, or valid credentials purchased from initial access brokers.
- Establishment & Discovery — Deployment of commodity tooling (Cobalt Strike–style beacons, RMM tools abused for persistence), followed by network and Active Directory discovery using built-in utilities (
net,nltest,adfind). - Defense Evasion & Impact Preparation — Before encryption, operators almost universally attempt to inhibit recovery: deleting Volume Shadow Copies, disabling Windows recovery boot options, stopping backup agents, and tampering with security tooling.
- Mass Encryption — The ransomware payload is staged and executed across hosts, frequently via PsExec, Group Policy, or RMM tooling, encrypting files and dropping ransom notes.
Exploitation Status
This is confirmed active exploitation in the wild — the joint U.S./South Korean warning exists because real intrusions against real government and critical infrastructure networks have been observed. There is no single CVE at the center of this campaign; Gunra is a ransomware operation, not a vulnerability. That means your defensive posture cannot rely on patching a single bug — it must be behavioral.
The Critical Detection Window
The most actionable point in the kill chain is Phase 3 — impact preparation. Encryption itself is fast and noisy; by the time files are being renamed, you are in incident response mode. But the pre-encryption behaviors — shadow copy deletion, bcdedit recovery tampering, backup service termination, suspicious use of PsExec and remote tooling — are detectable, relatively low-noise, and give you a fighting chance to isolate hosts before domain-wide encryption.
Detection & Response
The detections below target the highest-fidelity pre-encryption and execution behaviors common to ransomware operations of this type. They are tuned to minimize noise: legitimate administrators do delete shadow copies, and legitimate tools do use PsExec — so pair these with baseline knowledge of your own admin activity and alert on anomalies, not existence.
Sigma Rules
---
title: Ransomware Impact Preparation - Shadow Copy and Recovery Tampering
id: 9c2e7a41-3b6d-4f08-a1e5-7d8c2b4f9012
status: experimental
description: Detects deletion of Volume Shadow Copies or disabling of Windows recovery options, a hallmark pre-encryption behavior observed in ransomware operations including Gunra-type campaigns.
references:
- https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: '\vssadmin.exe'
CommandLine|contains:
- 'delete shadows'
- 'Delete Shadows'
selection_wmic:
Image|endswith: '\wmic.exe'
CommandLine|contains:
- 'shadowcopy delete'
- 'shadowcopy'
CommandLine|contains|all:
- 'delete'
selection_bcdedit:
Image|endswith: '\bcdedit.exe'
CommandLine|contains:
- 'recoveryenabled'
- 'bootstatuspolicy'
CommandLine|contains|all:
- 'ignoreallfailures'
selection_vss_resize:
Image|endswith: '\vssadmin.exe'
CommandLine|contains:
- 'resize shadowstorage'
condition: 1 of selection_*
falsepositives:
- Legitimate storage administrators resizing shadow storage
- Backup software performing shadow copy lifecycle management (baseline by parent process)
level: high
---
title: Ransomware Defense Evasion - Backup and Security Service Termination
id: 4f1b8c63-2e7a-4d95-b3c1-8a6f0d2e5b47
status: experimental
description: Detects attempts to stop or disable backup agents, VSS, or security services commonly targeted by ransomware operators prior to mass encryption.
references:
- https://attack.mitre.org/techniques/T1562.001/
- https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.defense_evasion
- attack.t1562.001
- attack.impact
logsource:
category: process_creation
product: windows
detection:
selection_net_stop:
Image|endswith:
- '\net.exe'
- '\net1.exe'
- '\sc.exe'
CommandLine|contains:
- 'stop'
CommandLine|contains:
- 'vss'
- 'wbengine'
- 'backup'
- 'veeam'
- 'backup exec'
- 'sqlwriter'
- 'mssqlserver'
- 'sophos'
- 'sentinelagent'
- 'csagent'
- 'defender'
selection_taskkill:
Image|endswith: '\taskkill.exe'
CommandLine|contains:
- 'sql'
- 'backup'
- 'veeam'
- 'vss'
condition: 1 of selection_*
falsepositives:
- Scheduled maintenance scripts stopping database or backup services
- Software deployment tooling restarting security agents
level: high
---
title: Suspicious Ransomware Staging via PsExec or Admin Share Execution
id: 7d3a9f12-5c8e-4b61-a4d9-2f7e1c8b3094
status: experimental
description: Detects remote execution patterns consistent with ransomware operators staging encryption payloads across hosts via PsExec-style tooling or ADMIN$ share deployment, typical in the lateral movement phase of government-targeting campaigns.
references:
- https://attack.mitre.org/techniques/T1569.002/
- https://attack.mitre.org/techniques/T1021.002/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.lateral_movement
- attack.t1021.002
- attack.execution
- attack.t1569.002
logsource:
category: process_creation
product: windows
detection:
selection_psexec:
Image|endswith:
- '\psexec.exe'
- '\psexesvc.exe'
- '\paexec.exe'
- '\remcom.exe'
selection_service_creation:
Image|endswith: '\sc.exe'
CommandLine|contains:
- '\\\\'
- 'create'
- 'binpath'
selection_admin_share_copy:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- '\\\\'
- 'ADMIN$'
CommandLine|contains:
- 'copy'
- 'xcopy'
- 'Copy-Item'
condition: 1 of selection_*
falsepositives:
- Enterprise software deployment and legitimate remote administration (baseline known admin accounts, jump hosts, and deployment servers and suppress those sources)
level: medium
KQL — Microsoft Sentinel / Defender Hunt
This hunt query correlates the pre-encryption kill chain across a host: shadow copy tampering followed by service termination followed by mass file rename/encryption-like activity. Even one leg of this chain warrants investigation; two or more on the same host within an hour is a page-the-on-call event.
// Gunra-style ransomware precursor hunt: impact preparation behaviors on Windows endpoints
let TimeWindow = 1h;
let ShadowTamper = DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled", "ignoreallfailures"))
| project ShadowTime=TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, ShadowCmd=ProcessCommandLine;
let ServiceKill = DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ("net.exe", "net1.exe", "sc.exe", "taskkill.exe")
| where ProcessCommandLine has_any ("vss", "backup", "veeam", "wbengine", "sqlwriter", "sophos", "sentinelagent", "csagent")
| project KillTime=TimeGenerated, DeviceName, KillCmd=ProcessCommandLine;
let MassRename = DeviceFileEvents
| where TimeGenerated > ago(24h)
| where ActionType == "FileRenamed"
| summarize RenameCount=count(), DistinctExtensions=dcount(tostring(split(FileName, ".")[-1])) by DeviceName, bin(TimeGenerated, 5m)
| where RenameCount > 200
| project RenameTime=TimeGenerated, DeviceName, RenameCount;
ShadowTamper
| join kind=inner ServiceKill on DeviceName
| where KillTime between (ShadowTime .. ShadowTime + TimeWindow)
| join kind=leftouter MassRename on DeviceName
| where isnull(RenameTime) or RenameTime between (ShadowTime .. ShadowTime + TimeWindow)
| project DeviceName, ShadowTime, ShadowCmd, KillTime, KillCmd, RenameTime, RenameCount, InitiatingProcessAccountName
| sort by ShadowTime asc
For Linux-heavy environments ingested via Syslog/CEF, hunt for the equivalent precursors — mass file modification, deletion of snapshots/backups, and unexpected service stops:
// Linux precursor hunt via Syslog ingestion
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName in ("rm", "find", "openssl", "dd", "systemctl")
| where SyslogMessage has_any ("--delete", "/var/backups", "snapshot", "stop postgresql", "stop mysql", "stop mariadb")
or (SyslogMessage has "rm" and SyslogMessage has "-rf")
| summarize Commands=make_set(SyslogMessage, 10), Count=count() by Computer, HostUserName, bin(TimeGenerated, 10m)
| where Count > 3
| sort by TimeGenerated asc
Velociraptor VQL
Use this artifact during proactive hunts or triage on a suspected host to surface recently executed binaries in user-writable staging locations alongside evidence of shadow copy tampering:
-- Hunt for ransomware staging artifacts: recently executed binaries in user-writable
-- paths plus shadow copy state on suspected hosts
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(\\\\Users\\\\[^\\\\]+\\\\(AppData|Downloads|Temp)|\\\\ProgramData\\\\[^\\\\]+)\\\\[^\\\\]+\.exe$'
OR CommandLine =~ '(?i)(vssadmin.*delete|bcdedit.*recoveryenabled|shadowcopy.*delete)'
SELECT * FROM procs
-- Enumerate Volume Shadow Copies: absence of shadows on a server that should have them
-- is a strong indicator of T1490 Inhibit System Recovery
LET shadows = SELECT * FROM execve(argv=[
"C:\\Windows\\System32\\vssadmin.exe", "list", "shadows"
])
SELECT * FROM shadows
-- Find recently created ransom-note-like files and high-velocity file modifications
-- in the last 2 hours across common data directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
"C:\\**\\*README*.txt",
"C:\\**\\*DECRYPT*.txt",
"C:\\**\\*RESTORE*.txt",
"C:\\**\\*HOW_TO*.txt"
], accessor="ntfs")
WHERE Mtime > now() - 7200
ORDER BY Mtime DESC
LIMIT 500
Hardening & Verification Script
Run this on critical Windows servers to verify that recovery mechanisms are intact, VSS is protected, and key ransomware-mitigation controls are enabled. It is read-only verification plus optional enforcement of controlled folder access — review before running in production.
# Gunra-style ransomware readiness check for Windows servers/endpoints
# Run elevated. Review each section before enabling enforcement flags.
Write-Host "=== Volume Shadow Copy Status ===" -ForegroundColor Cyan
vssadmin list shadows
vssadmin list shadowstorage
Write-Host "`n=== Boot Recovery Configuration (should NOT show ignoreallfailures) ===" -ForegroundColor Cyan
bcdedit /enum {current} | Select-String -Pattern "recoveryenabled|bootstatuspolicy"
Write-Host "`n=== Backup & VSS Service State ===" -ForegroundColor Cyan
Get-Service -Name VSS, wbengine -ErrorAction SilentlyContinue |
Select-Object Name, Status, StartType | Format-Table -AutoSize
Write-Host "`n=== Microsoft Defender Tamper Protection & PUA ===" -ForegroundColor Cyan
Get-MpPreference | Select-Object EnableControlledFolderAccess, PUAProtection, DisableRealtimeMonitoring
Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled, AntivirusEnabled
Write-Host "`n=== Controlled Folder Access (ransomware mitigation) ===" -ForegroundColor Cyan
$cfa = (Get-MpPreference).EnableControlledFolderAccess
if ($cfa -eq 0) {
Write-Host "Controlled Folder Access is DISABLED. To enable in AUDIT mode first:" -ForegroundColor Yellow
Write-Host ' Set-MpPreference -EnableControlledFolderAccess AuditMode' -ForegroundColor Yellow
# After auditing for false positives, enforce with:
# Set-MpPreference -EnableControlledFolderAccess Enabled
}
Write-Host "`n=== Recent suspicious precursor process events (last 24h) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'vssadmin.*delete|bcdedit.*recoveryenabled|shadowcopy.*delete|psexec' } |
Select-Object TimeCreated, Message -First 25 | Format-List
Write-Host "`n=== RDP exposure check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) { Write-Host "RDP is ENABLED - verify it is not internet-exposed and requires NLA + MFA at the gateway." -ForegroundColor Yellow }
Remediation & Defensive Priorities
There is no single patch for a ransomware operation — remediation here is architectural. Prioritize in this order:
- Isolate and validate your backups today. Confirm you have offline or immutable backups (object-lock, air-gapped copies, or WORM storage) that ransomware cannot reach with domain credentials. Test a restore — an untested backup is a hope, not a control. Ensure backup service accounts are separate from domain admin credentials and cannot be used interactively.
- Reduce the initial-access surface. Inventory and patch internet-facing VPNs, firewalls, remote access gateways, and remote management tools. Disable or strictly gate RDP exposure. Enforce phishing-resistant MFA (FIDO2/passkeys) on all remote access and privileged accounts.
- Deploy the detections above. The Sigma rules, KQL hunt, and VQL artifacts in this post target the highest-fidelity pre-encryption behaviors. Tune them against your administrative baselines and route alerts to a 24/7 monitored queue.
- Harden recovery mechanisms. Alert on any
vssadmin delete shadows,bcdeditmodification, or backup service stop as a high-severity event. Enable Microsoft Defender Controlled Folder Access (audit mode first, then enforce) on critical servers. - Constrain lateral movement. Tier your Active Directory, disable PsExec-style remote service creation where not operationally required, restrict workstation-to-workstation SMB/RPC via host firewall policy, and monitor for service creation across the fleet.
- Prepare the response plan before you need it. Pre-stage isolation runbooks, define who can declare an incident and pull network access, and retain IR counsel and a DFIR partner on contract. Review CISA's #StopRansomware guidance and the joint advisory from the U.S. and South Korean agencies for organization-specific recommendations at cisa.gov/stopransomware.
- If you are hit: do not power off hosts (memory and volatile evidence matter), isolate at the network segment level, preserve logs and ransom notes, and engage law enforcement — FBI/CISA in the U.S., and the National Police Agency in South Korea — as early as possible.
Government and critical infrastructure operators are being specifically and deliberately targeted. The organizations that survive these campaigns with minimal damage are the ones that detected the preparation phase — not the ones that noticed the ransom note.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.