On 10 August 2026, CISA, the FBI, and partner agencies published joint Cybersecurity Advisory AA26-222A, #StopRansomware: Gunra Ransomware. A CISA press release the same week restated the public facts and corrected a CVE link. This note stays inside those two pages. It does not invent victim counts, a dollar band, or a claim that any portfolio company was hit.
What the agencies actually published
Gunra is described as ransomware-as-a-service. The advisory says the variant appeared in 2025 and expanded into RaaS operations in 2026. The model is double extortion: encrypt data and threaten to publish stolen files if a ransom is not paid. The press release adds that negotiations run through a Tor portal, with a five-to-seven-day payment threat.
Initial access, as the authoring agencies wrote it, is not a mystery exploit. The FBI observed exploitation of two Fortinet authentication-bypass CVEs on internet-facing devices: CVE-2024-55591 and CVE-2025-24472. The press release notes that an earlier link pointed at the wrong CVE (CVE-2024-5559) and should have pointed at CVE-2024-55591. If a portco ticket still cites the wrong identifier, the ticket is already stale.
Named sectors in the press release include healthcare and public health, financial services, government services and facilities, and professional and nonprofit services. That is a targeting description. It is not a census of your fund.
Published mitigations are the ones every operating partner has already heard and still has to verify: patch known exploited internet-facing systems, keep backups immutable and offline-tested, and segment so one compromised device is not a path across the estate.
The hold-period cut
Do not forward the advisory as a board scare. Do send four questions that an honest CISO can answer with evidence, not adjectives.
Which internet-facing Fortinet or VPN appliances are in this company, and which versions? If nobody can produce an inventory dated after the advisory, you do not have a Gunra problem yet. You have an asset-inventory problem.
Are CVE-2024-55591 and CVE-2025-24472 closed, waived, or unknown? Unknown is the expensive answer. A waiver needs an owner, a compensating control, and a date.
Where do backups actually live, and when were they last restored? The advisory’s backup line is only useful if someone can show a tested restore, not a checkbox.
If this path opened, which revenue system sits on the far side of the segment? That is the join from a CVE to a P10–P90 loss-exposure range. The advisory does not make that join. A labeled evidence file does.
Valty’s current offer is a capacity-capped, one-company design-partner sprint that connects verified control posture and financial-risk inputs to an EBITDA-impacting cyber loss-exposure range, net of insurance when transfer is modeled. A joint advisory is a source. It is not that range.
What this does not prove
It does not prove a dollar outcome for any portfolio company. A public advisory is not a tenant evidence file.
It does not certify that a portco is safe, unsafe, CMMC-ready, or insurable. CISA and the FBI are not underwriting your renewal.
It does not replace counsel on disclosure, notification, or materiality. If an incident is already in progress, that call belongs to the company and its advisors.
It does not let Valty claim a first-party detection, a victim count, or that we observed Gunra in a design-partner environment.
If you want to see how a labeled artifact keeps method, source, and confidence visible, inspect the sample proof. If you want that work on one company, apply as a design partner.
Sources
- CISA, #StopRansomware: Gunra Ransomware (AA26-222A) — 10 August 2026
- CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors — press release, 10 August 2026, revised 11 August 2026
- CVE-2024-55591
- CVE-2025-24472
Limitations
This brief summarizes the public CISA pages only. It does not reproduce the full IOC list or detection appendix, and it does not treat a press quote as a loss model. If a portco needs the technical package, open AA26-222A. If they need a priced range, that still requires their evidence.