[gunra]

August 11, 2026

• FBI and South Korea warned that the Gunra RaaS gang is breaching critical infrastructure via firewall vulnerabilities. Gunra, which moved to a RaaS model in 2026, uses double extortion with a dedicated leak site against government and critical-infrastructure targets (The Record, CISA). · Threat Activity

in Metabase Zero-Day Blast Radius Widens to LexisNexis and Framework

August 2, 2026

• South Korean state-sponsored campaign abuses AnySign4PC via compromised sites. Authorities and four security firms detailed a watering-hole operation exploiting locally installed financial-security software to silently deploy SIGNBT and COPPERHEDGE backdoors with no user prompt (The Hacker News). A parallel "Operation Double Barrel" abuses WebSocket buffer overflows in two Korean financial-security products, with one intrusion chain delivering Gunra ransomware (blackorbird). · Threat Intelligence

in Coldcard Wallet Theft Climbs Past $88M as Attackers Drain Weak-Entropy Addresses in Waves