Gunra is a financially motivated ransomware-as-a-service group that emerged in April 2025, operating a fully-featured affiliate management panel. The group’s ransomware, written in C/C++, is believed to be based on the leaked source code of the Conti ransomware. Gunra distinguishes itself through a strict five-day deadline for victims to negotiate ransom payments and its cross-platform capabilities, targeting Windows, Linux, ESXi, and NAS environments. The group employs a double-extortion model, encrypting data while also exfiltrating sensitive information for publication on a dark web leak site if demands are not met. Gunra conducts negotiations through Tor-based portals designed to mimic popular messaging applications. The group has shown a tendency to avoid targeting United States-based entities, focusing instead on a diverse international victimology.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker