Gunra
Gunra is a ransomware family and ransomware-as-a-service (RaaS) operation first observed in 2025 and assessed in multiple reports as Conti-derived. It initially appeared as a Windows-focused locker and later expanded to Linux, with reporting also stating affiliate advertising claimed support for Windows, Linux, ESXi, and NAS across x86 and ARM architectures. Gunra uses a double-extortion model: it encrypts victim files and exfiltrates data for leak-based extortion via Tor-hosted infrastructure. It has been linked to dark web recruitment and operations on forums including RAMP, Rehub, Tierone, and Darkforums, and reporting states it launched an affiliate program in January 2026.
On Windows, Gunra encrypts files and appends the .ENCRT extension, while dropping ransom notes named R3ADM3.txt. The ransom note instructs victims to use Tor and references the onion negotiation portal nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd[.]onion. Technical reporting describes a hybrid encryption design using ChaCha20 for file encryption and RSA-4096 to protect per-file key material; Windows samples were reported to generate keys with BCryptGenRandom or CryptGenRandom. The malware enumerates drives A: through Z:, recursively traverses directories, excludes system-critical paths such as C:\Windows and C:\Program Files, excludes extensions including .exe, .dll, and .sys, avoids re-encrypting .ENCRT files, and may store RSA-encrypted per-file key bundles in appended data or separate .keystore files. Additional reported Windows behaviors include process and file enumeration, system information collection, debugger detection via IsDebuggerPresent, shadow copy deletion via WMI, and use of GetCurrentProcess and TerminateProcess.
On Linux, Gunra has been observed as a compact statically linked ELF binary targeting enterprise servers and supporting multiple architectures including x86-64, i386, and ARM. Linux-encrypted files are reported to receive the .GNRA extension, with .keystore files containing RSA-encrypted per-file symmetric keys and encrypted files carrying a footer marked ENCRT. The Linux variant reportedly skips critical directories such as /proc, /bin, /usr, /boot, /dev, /etc, /lib, /lib64, /run, /sbin, /srv, /sys, and /tmp, while targeting locations such as /home, /var, /opt, /root, /mnt, and /media. Reported post-compromise actions include renaming files, deleting logs, modifying PAM, Polkit, sudoers, cron jobs, init scripts, and Bash startup scripts. One report identified a significant cryptographic weakness in the Linux variant: ChaCha20 key material generated via musl-libc rand() seeded with time(), making .GNRA files potentially recoverable by brute-forcing seeds within the encryption time window; this weakness was reported not to affect the Windows variant.
Gunra has been reported affecting organizations globally, including victims in South Korea, Japan, Egypt, Panama, Italy, Argentina, Brazil, Canada, Turkey, Taiwan, and the United States. Sectors explicitly mentioned in reporting include real estate, pharmaceuticals, manufacturing, hospitals, infrastructure, and broader industrial environments. Reporting states Gunra initially targeted companies in South Korea, later claimed more than 20 victims across eight countries, and had 32 confirmed victim organizations by March 9, 2026. One report states Gunra attacked INHA University in South Korea in December 2025 and exfiltrated 650 GB of data. Gunra has also been cited in industrial-sector ransomware tracking and in reporting on extortion-first campaigns.
Operationally, Gunra is described as maintaining centralized oversight through a hosted affiliate panel with functions such as Negotiation, Files, Lock Tool, Handler, and Brand Setting. Reporting states operators directly participate in victim negotiations and that the platform supports white-label branding, allowing affiliates to launch technically related attacks under different ransomware names. Reported ransom demands were in the USD 7 million to USD 10 million range with a five-day payment deadline. High-confidence indicators directly mentioned in the source material include the .ENCRT and .GNRA encrypted-file extensions, ransom note R3ADM3.txt, .keystore artifacts, the ENCRT footer marker, and the onion portal nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd[.]onion.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
Persistence
4 techniques
Persistence
Behavioral Profile: What It Does on a Live System ... Modifies init.d / rc scripts ... Modifies Bash startup scripts ... MITRE ATT&CK Mapping ... Persistence Boot or Logon Initialization Scripts T1037
Behavioral Profile: What It Does on a Live System ... Creates/modifies cron jobs ... MITRE ATT&CK Mapping ... Persistence Scheduled Task/Job: Cron T1053.003
Privilege Escalation
3 techniques
Privilege Escalation
Behavioral Profile: What It Does on a Live System ... Modifies init.d / rc scripts ... Modifies Bash startup scripts ... MITRE ATT&CK Mapping ... Persistence Boot or Logon Initialization Scripts T1037
Stealth
5 techniques
Stealth
This includes “obfuscation of malicious activity, avoidance of rule-based detection systems, strong encryption methods, ransom demands, and warnings to publish data on underground forums.”
"final cleanup: shutting down the thread pool, zeroing out sensitive memory (including encryption keys), and exiting cleanly"
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Discovery
4 techniques
Discovery
Exfiltration
2 techniques
Exfiltration
Impact
2 techniques
Impact
Gunra ransomware is a relatively recent threat that targets Windows systems with a combination of advanced encryption and data exfiltration strategies. This “double-extortion” approach is a key characteristic, as the ransomware not only encrypts victims’ files but also threatens to leak stolen data on its Tor-hosted extortion site.
IOCs tracked for this family
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Gunra is a ransomware operation that evolved into a Ransomware-as-a-Service ecosystem. It provides affiliates with a web-based panel to manage attacks, negotiations, victim files, payload building, and payments, with support for both Windows and Linux payloads.
Conti-derived ransomware that expanded from Windows to Linux, including x86-64, i386, and ARM ELF builds. It encrypts files using a ChaCha20 + RSA-4096 hybrid scheme, appends the .GNRA extension on Linux and .ENCRT on Windows, drops the R3ADM3.txt ransom note, and operates as a ransomware-as-a-service affiliate program. The Linux variant contains a weak PRNG implementation using musl-libc rand() seeded by time(), making Linux-encrypted files potentially recoverable by brute force.
Gunra is a Ransomware-as-a-Service operation with an affiliate panel/builder that generates a “locker” payload. The ransomware targets primarily Windows (with claimed cross-platform support for Linux/ESXi/NAS), performs offline file encryption using a ChaCha20 + RSA-4096 hybrid scheme (per-file ChaCha20 keys/nonces protected by embedded RSA public key), selectively avoids system directories/extensions to keep systems usable, renames encrypted files with .ENCRT, and drops ransom notes (R3ADM3.txt) directing victims to a Tor .onion payment portal.
A ransomware family that emerged in 2025, using phishing and SaaS abuse as initial access vectors.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.