Gunra

Gunra is a Conti-derived ransomware family and ransomware-as-a-service operation first observed in 2025. It initially appeared in attacks against South Korean organizations and later expanded into a broader global extortion operation affecting sectors including healthcare, manufacturing, IT, pharmaceuticals, real estate, and other enterprise environments. Gunra has been associated with double-extortion activity in which operators steal data before encrypting systems and threaten publication through Tor-based leak infrastructure if victims do not pay.

Gunra supports both Windows and Linux environments, and reporting also indicates affiliate marketing that advertised broader cross-platform support. On Windows, Gunra encrypts files, appends a characteristic encrypted-file extension, and drops ransom notes in affected directories. It has been observed enumerating files and processes, collecting system information, deleting shadow copies, and using anti-analysis checks such as debugger detection. It also disables or interferes with backup and security controls to hinder recovery. On Linux, Gunra was developed into a compact ELF locker targeting enterprise servers and avoiding certain critical system directories to preserve system operability during extortion. Linux variants have also been reported modifying authentication, privilege, scheduled-task, and startup-related configurations to maintain access or facilitate post-compromise operations.

Gunra evolved from early Conti-based code into a more mature affiliate-driven platform with centralized management features for payload generation, negotiation, and branding. By early 2026 it had transitioned into a formal RaaS model, recruiting affiliates on criminal forums and enabling white-label use that could cause technically related attacks to appear under different names. Operators have been reported to participate directly in negotiations, indicating centralized oversight beyond simple payload leasing.

Gunra intrusions have been linked to multiple initial-access patterns. High-confidence reporting ties some South Korean incidents to exploitation of vulnerabilities in locally deployed financial security software through watering-hole attacks on compromised legitimate websites, as well as spearphishing. In those cases, Gunra activity overlapped technically with a separate espionage-focused intrusion cluster dubbed Operation Double Barrel, including shared exploit paths, tooling characteristics, infrastructure elements, and anti-forensic behavior. Assessments indicate Gunra and the espionage actor were likely distinct operators with different end goals, but may have shared tools, infrastructure, access, or collaborated in a limited manner. Some reporting specifically notes overlap with activity attributed to Lazarus, though definitive attribution of Gunra itself to a state actor is not established.

Gunra is primarily used for financially motivated extortion. Its operational model combines encryption, data theft, anti-forensic measures, and affiliate enablement, making it a notable emerging ransomware threat across both workstation and server environments.