Gunra ransomware has quickly grown from an emerging threat in South Korea into a broader international concern.

U.S. and South Korean cybersecurity authorities are warning organizations about Gunra activity affecting government and critical infrastructure environments. For security teams, Gunra shows how quickly a relatively new ransomware operation can scale once it develops reliable tooling and begins recruiting affiliates.

Gunra emerged in South Korea before expanding

Gunra was first observed in April 2025 after attacks against five South Korean organizations.

According to the joint advisory, the operation initially used ransomware based on leaked Conti source code before developing its own malware. Gunra later moved toward a ransomware-as-a-service model, allowing affiliates to use the group’s malware and infrastructure to conduct attacks.

As of March 9, 2026, security firm S2W had identified 32 organizations affected by Gunra activity.

The affiliate model can help ransomware operations expand because the core developers do not need to conduct every intrusion themselves. Affiliates can target additional victims while the ransomware operators provide malware, infrastructure, and supporting tools.

Researchers, BleepingComputer reports, have also identified Gunra ransomware, which can target both Windows and Linux systems. This broadens the range of enterprise environments that may be affected.

S2W said Gunra does not restrict affiliates from targeting particular industries, increasing the potential scope of its operations.

US warning raises the stakes

The U.S. warning puts additional focus on the risks Gunra poses to government agencies and critical infrastructure operators.

Ransomware incidents in these environments can cause consequences beyond data loss. Disruptions may affect public services, healthcare operations, transportation systems, and other essential services that organizations cannot easily take offline.

Gunra also uses double-extortion tactics, in which attackers steal data before encrypting systems. Victims may therefore face both operational disruption and the potential exposure of sensitive information.

The operation’s rapid development also demonstrates how quickly ransomware groups can mature once they build their own tooling and attract affiliates.

Familiar ransomware defenses remain important

Many of the defenses that can reduce the impact of ransomware remain well established.

Organizations should keep internet-facing systems, including VPNs, firewalls, and remote-access services, fully patched and remove unnecessary external exposure wherever possible.

Security teams should also strengthen remote-access and privileged accounts with strong authentication controls, including phishing-resistant multifactor authentication where available.

Network segmentation can limit how far attackers move after gaining initial access. Separating corporate user networks, administrative systems, servers, and operational technology can help prevent a compromise in one environment from spreading across an organization.

Teams should also monitor for suspicious administrator activity, unusual remote sessions, credential abuse, and large outbound data transfers that may indicate an intrusion before ransomware is deployed.

Backups should be isolated from production environments and tested regularly so organizations can recover if systems are encrypted or recovery mechanisms are targeted.

Gunra remains a relatively young ransomware operation, but its progression from early attacks in South Korea to a broader ransomware-as-a-service operation shows how quickly new groups can develop.

For defenders, the fundamentals still matter most: reduce exposed access, strengthen authentication, limit lateral movement, and protect the systems needed for recovery.

Other News: Google said a malware warning that temporarily blocked access to some Blogger sites was a false positive, not evidence that the affected blogs were compromised.

TL;DR: Dictate emails, notes, and reports as clean formatted text with a Contextli Pro Plus lifetime subscription on sale for $199.99 (reg. $2,450).

Professionals lose hours a week typing out emails, notes, and reports, and most dictation apps hand back a raw transcript that still needs cleanup. Contextli Pro Plus is a new dictation tool that takes voice input and formats it for the task in front of you, and a lifetime plan is on sale for $199.99 (reg. $2,450).

Turn spoken words into finished, formatted text

Speak naturally, and Contextli transcribes what you say, then cleans up and shapes the text based on what you’re writing. Customizable Contexts let a team build repeatable workflows for emails, support replies, documents, code, and marketing notes, so a dictated Slack message reads as a Slack message and an email reads like an email. Streaming transcription shows the words as you talk, so a fast-moving workday doesn’t stall waiting on the software.

This version adds cloud sync across devices for your Contexts, settings, and history, plus priority support when something needs a fast answer. Premium AI models handle complex reasoning and longer-form writing, and 99 supported languages handle teams working across different regions. Global and per-context hotkeys start dictation in a keystroke, and a custom dictionary keeps industry terms and product names spelled right.

Contextli’s lifetime plan includes 48,000 one-time credits, with one credit equal to a minute of cloud transcription, and those credits never expire or reset. Once they run out, Bring Your Own Key mode connects your own provider API keys, or complete offline mode runs local AI and transcription on your device with no credit use at all.

You don’t have to take minutes anymore.

Get a Contextli Pro Plus lifetime subscription for $199.99.

StackSocial prices subject to change.

Thrive Holdings has raised $2 billion in new funding at a $12 billion valuation from investors like SoftBank, D1 Capital Partners, and Altimeter Capital. 

Thrive Holdings is akin to a private equity firm for AI, buying traditional businesses like accounting firms and implementing AI into their workflows. So far, Thrive has focused on accounting and information technology, but part of Wednesday’s raise will go towards expanding a new vertical in physical assets. Key to that strategy is Thrive’s close relationship with OpenAI. 

The New York Times was first to report the news. 

The firm is a spinout of Thrive Capital, one of OpenAI’s major investors. In December 2025, OpenAI took an ownership stake in Thrive Holdings. Part of the deal involved OpenAI sending employees to work with Thrive’s companies to accelerate AI adoption. 

That hands-on model of AI implementation has become a business in its own right, and may help explain investor enthusiasm behind Thrive’s latest fundraise. OpenAI and Anthropic have both partnered with large private equity firms to launch The Deployment Company and Ode with Anthropic, respectively — billion-dollar ventures that are building teams of elite engineers who embed themselves into enterprises and implement AI solutions into workflows. 

The raise comes off the back of proven success for Thrive’s companies, which has surpassed 70 businesses on the Holdings platforms. The company has focused on two pillars to date: Current, its accounting arm with more than 50 firms and more than 2,000 professionals, and Shield, its information technology arm with around 20 companies on the platform. 

Current’s self-improving tax agents, dubbed TaxAI, processed more than 7,000 tax returns at 98% accuracy, lowering tax prep times at participating firms by over 30%, according to Thrive. Meanwhile, Shield’s AI products have sped up help desk resolution times by 36x, and the platform has doubled the number of custom AI agents deployed in the last month. 

Part of Wednesday’s fundraise will help Thrive launch a third platform focused on regulatory services for the built environment, described by a spokesperson as: “the work required to get physical assets approved, built, certified, and kept in operation.”

“The U.S. needs to build and modernize more critical infrastructure, but projects are often constrained by local, technical, and regulatory complexity,” Anuj Mehndiratta, a founding member of Thrive Holdings, told TechCrunch. “This applies across data centers, manufacturing, healthcare, power, water, transportation, and other physical infrastructure.”

That sort of complexity is where Thrive, well, thrives — large, fragmented, mission-critical, and operationally complex. While Mehndiratta says AI won’t replace field work, local judgement, or professional sign-off, it can help ease manual workflows like research, reporting, permit preparation, inspection documentation, and compliance tracking. 

“We think AI partnered with a lot of the experts and practitioners at these businesses can really help compress [regulatory bottlenecks], keep the safety standards high, but also be able to do it with less of a burden to the actual building of that and help it do it more efficiently, lower cost and do it faster,” Kareem Zaki, a founding member of Thrive Holdings, said in a statement emailed to TechCrunch.