GUNRA

GUNRA is an emerging ransomware group that appeared in 2024, conducting double-extortion attacks against corporate targets across multiple sectors. The group deploys ransomware to encrypt victim files while simultaneously exfiltrating sensitive data, operating a Tor-based leak site where stolen information is published if ransom demands are not met within their specified deadline windows.

GUNRA has claimed attacks against organisations in the manufacturing, logistics, and professional services sectors, primarily in Asia and Europe. Their ransomware payload demonstrates competent technical development, with the ability to encrypt both Windows desktop environments and server infrastructure. The group's ransom demands are calibrated to mid-market enterprise victim sizes, typically ranging from tens of thousands to several hundred thousand dollars.

The group's initial access methodology appears to rely primarily on exploitation of exposed remote desktop services, phishing campaigns, and credential theft from previous breach compilations. Following initial access, GUNRA operators conduct manual reconnaissance to identify high-value data stores before deploying their encryption payload , a pattern consistent with experienced operators prioritising data exfiltration value over rapid deployment speed.

GUNRA represents the continued proliferation of new ransomware operations in the post-LockBit disruption landscape, as experienced cybercriminals establish independent operations or smaller RaaS platforms to fill gaps left by law enforcement actions against major established groups. Their emergence reflects the persistent demand for ransomware-as-a-service capabilities within the cybercriminal ecosystem.

GUNRA (2024-) is a double-extortion crew. CyberAsia’s 2026 coverage includes their use of Fortinet edge flaws as initial access, consistent with other mid-tier groups that would rather buy or reuse a VPN bug than write a new loader. Payload work is competent on Windows servers. Demands sit in the mid-market band.

If you still expose SSL-VPN on IPv4, you are in their default scan. Patch FortiOS, disable unused SSL-VPN, and rotate every password that ever lived on that appliance. A leak-site timer is a claim until you confirm encryption or a stolen file share inside your own tenant.