Gunra ransomware threat – 3 steps Dutch businesses must take today

Why Dutch businesses must act now against Gunra ransomware

A warning from US and South Korean authorities says Gunra ransomware is actively hunting businesses that expose internet‑facing devices such as firewalls, VPNs or remote‑desktop gateways. For a small‑business owner, a successful attack can mean encrypted files, a public leak of customer data, and days – or weeks – of lost revenue. The good news is that you can block the attackers today with three simple steps that don’t require deep technical knowledge.

What is the Gunra ransomware gang and why it matters to you

Gunra is a “ransomware‑as‑a‑service” (RaaS) operation. In plain language, the group builds ransomware tools and then rents them out to other criminals through a dark‑web affiliate program. Their version uses a double‑extortion model: they first encrypt a victim’s files and then threaten to publish or sell the stolen data unless a ransom is paid. The FBI and CISA have identified the gang as a growing threat to critical‑infrastructure and ordinary businesses alike.

How Gunra gains access through unpatched internet‑facing devices

The gang’s first move is to find internet‑facing devices that are not fully patched – for example, a VPN appliance that still runs an old version with a known vulnerability (such as CVE‑2024‑55591 (CVE numbers are public identifiers for known software vulnerabilities.) or CVE‑2025‑24472 (CVE numbers are public identifiers for known software vulnerabilities.)). Once they exploit that weakness, they can install a small “loader” that opens a back door. From there they move laterally across the network using standard Windows tools (SMB (a Windows file‑sharing protocol that lets computers talk to each other on a network)) to reach file servers, databases and email systems.

In short, if a device on your network can be reached from the internet and is missing the latest security updates, it is a prime target for Gunra.

Three immediate actions to stop Gunra ransomware

1. Patch every internet‑exposed device

   • Log into every firewall, router, VPN gateway, and remote‑desktop server that can be accessed from outside your office.
   • Check the vendor’s website for the latest firmware or software version and apply it immediately.
   • If a device is no longer supported, consider replacing it with a newer model that receives security updates.

2. Enable multi‑factor authentication (MFA) on all remote access

   • Many VPN and remote‑desktop products include MFA; check your settings and enable it if available.
   • MFA adds an extra step – a code sent to a phone or generated by an app – on top of the usual password, so even a stolen password is not enough to log in.

3. Verify that you have reliable, offline backups

   • Backups should be stored offline or in a service that keeps a separate copy not continuously connected to your network.
   • Test a restore at least once a month: can you retrieve a recent file without needing the live network?
   • Keep at least two backup generations – one recent and one older – so you can roll back if the latest copy is compromised.

These steps form a simple, low‑cost “first line of defence” that stops most ransomware attacks before they can encrypt anything.

Quick checklist to protect your business from Gunra

• All internet‑facing devices are running the latest firmware.
• MFA is enabled for every remote‑login account.
• Backups are stored offline or in a ransomware‑protected cloud, and a restore test has been performed this month.

If you can tick all three boxes, you have dramatically reduced the risk of a Gunra strike.

FAQ: Gunra ransomware – what small business owners ask

Q: My business only uses a single laptop and a cloud‑based accounting tool. Do I still need to worry?
A: Yes. Even a single laptop can be compromised if it connects to an insecure Wi‑Fi network or uses an outdated VPN client. The same three actions – patching, MFA, and backups – apply.

Q: I’m not sure which devices are internet‑facing. How can I find out?
A: Look for any hardware or software that allows connections from outside your office – VPN gateways, remote‑desktop services, web servers, or even a smart printer that you can access remotely. A quick inventory with a trusted IT partner can clarify this.

Q: What if I don’t have the time or expertise to patch everything myself?
A: You can schedule a short “patch day” with a local IT provider, or use a managed service that handles updates automatically. The key is to act now rather than waiting for the next alert.

Q: How much does a ransomware‑readiness check cost?
A: The initial readiness check is free for Dutch small businesses. If you decide to proceed with a full remediation project, we’ll discuss pricing based on the scope of work.

How IT Move NL can help

We’re offering a free ransomware‑readiness check for Dutch small businesses. Our Security & Protection team will:

• Scan your network for unpatched internet‑facing devices.
• Review your MFA configuration and suggest quick improvements.
• Audit your backup strategy and confirm that you can recover data without paying a ransom.

If you’d like to schedule the free assessment, simply reply to this article or email info@itmove.nl. Let’s make sure your business stays up and running, no matter what cyber‑criminals try.

---

Sources:

• Warning issued over Gunra ransomware gang as attacks ramp up globally
• Feds warn Gunra ransomware is exploiting known bugs to hit critical infrastructure
• Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks