Gunra

Gunra is a Conti-derived ransomware family and ransomware-as-a-service (RaaS) operation first observed in April 2025. Reporting states it was developed from leaked Conti v2 source code and later evolved from an initial Windows-focused locker into a broader affiliate-driven platform with support for both Windows and Linux payloads; affiliate advertising also claimed support for ESXi, NAS, x86, and ARM targets. Gunra uses a double-extortion model, encrypting files while also exfiltrating data for leak-based extortion via Tor-hosted infrastructure. Multiple sources describe it as impacting organizations globally, including victims in South Korea, Japan, Egypt, Panama, Italy, Argentina, Brazil, Canada, Turkey, Taiwan, and the United States, and affecting sectors such as manufacturing, pharmaceuticals, real estate, hospitals, infrastructure, and other enterprise environments.

On Windows, Gunra encrypts files and appends the .ENCRT extension, drops ransom notes named R3ADM3.txt, and uses a hybrid cryptosystem in which file contents are encrypted with ChaCha20 and per-file key material is protected with RSA-4096. CloudSEK reported the Windows variant generates per-file 32-byte ChaCha20 keys and 12-byte nonces using BCryptGenRandom, embeds an RSA-4096 public key, enumerates drives A: through Z:, recursively encrypts files, excludes system directories such as C:\Windows and C:\Program Files, excludes system-critical extensions including .exe, .dll, and .sys, and can store RSA-encrypted per-file key bundles either appended to encrypted files or in separate .keystore files. The ransom note instructs victims to use Tor and references the onion negotiation portal nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd[.]onion. Sources also state Gunra deletes shadow copies, disables backup and antivirus services, enumerates processes and files, collects system information, and uses anti-analysis techniques including debugger detection via IsDebuggerPresent and process manipulation via GetCurrentProcess and TerminateProcess.

Gunra later expanded to Linux, where Trend Micro and other reporting described a compact ELF locker targeting enterprise servers and supporting multiple architectures including x86-64, i386, and ARM. The Linux variant appends the .GNRA extension, creates .keystore files containing RSA-encrypted per-file symmetric keys, and appends a footer marked ENCRT to encrypted files. It traverses filesystems while skipping critical directories such as /proc, /bin, /usr, /boot, /dev, /etc, /lib, /lib64, /run, /sbin, /srv, /sys, and /tmp, while targeting locations such as /home, /var, /opt, /root, /mnt, and /media. Reported post-compromise behavior includes renaming files, deleting logs, modifying PAM, Polkit, sudoers, cron jobs, init scripts, and Bash startup scripts. A significant reported weakness in the Linux variant is flawed cryptography: researchers stated it generates ChaCha20 key material using musl-libc rand() seeded with time(), reducing the effective keyspace enough that .GNRA-encrypted files may be recoverable by brute-forcing candidate seeds within the encryption time window. This weakness was specifically reported not to affect the Windows variant.

Operationally, Gunra is described as a low-profile but growing RaaS ecosystem active on dark web forums including RAMP, Rehub, Tierone, and Darkforums, where it recruits affiliates, hires penetration testers, and sells stolen data. Reporting states the group launched an affiliate program in January 2026 and provides a hosted web panel with functions such as Negotiation, Files, Lock Tool, Handler, and Brand Setting. The platform reportedly supports centralized victim negotiation and white-label branding, allowing affiliates to launch attacks under different ransomware names. Sources note Gunra initially targeted South Korean organizations and later expanded globally, with dozens of claimed or confirmed victims by early 2026. High-confidence indicators and artifacts mentioned in the reporting include the .ENCRT and .GNRA encrypted-file extensions, ransom note R3ADM3.txt, .keystore artifacts, the ENCRT file footer, and the Tor negotiation portal noted above.