#StopRansomware: Gunra Ransomware Advisory

Gunra is a sophisticated Ransomware-as-a-service (RaaS) variant first observed in April 2025 that expanded to a formal affiliate program in early 2026, often operating under the alias 'Golden Community.' Derived from leaked Conti source code, the group employs a double-extortion model, exfiltrating data to a Dedicated Leak Site (DLS) while encrypting victim systems across Windows and Linux platforms. The threat actors focus on government and critical infrastructure sectors globally, often recruiting initial access brokers to facilitate entry.

Technically, Gunra affiliates prioritize the exploitation of known vulnerabilities in edge devices, specifically targeting Fortinet appliances (CVE-2024-55591, CVE-2025-24472) and VPN gateways. Once inside, they leverage common administrative tools like Impacket and OpenSSH for lateral movement and credential dumping. Their encryption routine uses a multi-threaded ChaCha20 + RSA-4096 architecture, though researchers have identified a cryptographic weakness in the Linux variant that may allow for data recovery.

The impact of Gunra is high due to the group's active efforts to delete volume shadow copies and destroy backup infrastructure to prevent recovery. The broad targeting and commercialized RaaS model indicate a persistent threat to organizations in the healthcare, financial services, and critical manufacturing sectors.