Gunra Ransomware Encryption Activity Detection

Ethan Andrews@eandrews

•updated Feb 27, 2026•3•0•36

Detects a high volume of file renaming operations to the '.ENCRT' extension, combined with the creation of the 'R3ADM3.txt' ransom note by the same process. This behavior is characteristic of the Gunra ransomware encryption routine.