Gunra widens reach with ransomware franchise

Gunra ransomware has expanded from a relatively narrow Windows-focused threat into a structured cybercrime franchise, raising concern among security teams as its operators shift from a Conti-derived locker to their own Ransomware-as-a-Service model.

The group, first observed in April 2025, initially drew attention after attacks on five companies in South Korea. Its early malware showed similarities to Conti, the once-dominant ransomware operation whose leaked source code reshaped the criminal market by allowing newer gangs to recycle and adapt proven encryption techniques. Gunra’s latest activity indicates a more independent phase, with dedicated infrastructure, affiliate recruitment and a proprietary locker designed for wider deployment.

The change matters because Ransomware-as-a-Service lowers the barrier for financially motivated attackers. Instead of a single group conducting every stage of an intrusion, the core operators provide malware, leak-site infrastructure, negotiation tools and payment systems, while affiliates carry out breaches and share proceeds. This model has made ransomware more scalable, harder to attribute and more difficult for defenders to disrupt.

Gunra’s victim count has continued to grow across multiple regions and sectors. Publicly tracked leak-site data now shows dozens of claimed victims, with manufacturing, healthcare, business services, financial services and technology among the most affected sectors. Brazil, South Korea, Hong Kong, the United Arab Emirates and Thailand appear among the geographies linked to claimed incidents. The group has also been associated with attacks on aviation, healthcare, consulting, agriculture and transport-related organisations.

Security researchers have identified a significant technical shift in Gunra’s tooling. Its RaaS-era locker uses hybrid encryption methods, combining fast symmetric encryption with public-key cryptography to lock files efficiently while protecting decryption keys from recovery. The malware has been described as configurable, allowing attackers to choose target directories, file extensions and operational parameters. That flexibility is particularly valuable for affiliates seeking to tailor attacks to different environments.

A Linux variant has further widened the group’s potential reach. The variant can run multiple encryption threads and supports partial encryption, allowing attackers to speed up disruption while reducing the time spent inside a compromised network. Such capability is important because many enterprise servers, virtualisation platforms and database environments rely on Linux systems. By moving beyond Windows endpoints, Gunra is positioning itself to target higher-value infrastructure.

The group’s tactics follow the double-extortion pattern now common in ransomware campaigns. Victims face file encryption and the threat of stolen data being published on leak sites if payment is not made. Gunra ransom notes have demanded contact through Tor-based channels and set short deadlines, increasing pressure on executives, legal teams and incident responders. The strategy is designed to force quick decisions before organisations can fully assess the scope of compromise.

The operational shift also reflects a wider cybercrime trend: ransomware groups are becoming more businesslike even as law-enforcement pressure fragments established brands. After major disruptions to groups such as LockBit and the collapse or rebranding of others, smaller actors have filled the space by adopting affiliate models, leak portals and modular toolsets. Gunra’s move from borrowed code towards an independent platform fits that pattern.

Defenders face several challenges. Conti-linked code and tactics remain familiar, but Gunra’s newer tooling complicates detection because affiliates can adjust execution parameters. Its anti-analysis and evasion features are intended to frustrate forensic work, while deletion of shadow copies and selective file targeting can weaken recovery options. The presence of both Windows and Linux variants means security teams must monitor across endpoints, servers and backup infrastructure rather than treating ransomware as a workstation-only threat.

The industries affected by Gunra are attractive targets because downtime carries immediate financial and operational costs. Manufacturing plants can face halted production lines; hospitals and clinics may confront disruption to patient services; business-services firms often hold sensitive client data; and transport operators can suffer reputational damage when passenger or operational systems are affected. These pressures make extortion more potent even when backups exist.