Are there any known vulnerabilities in the Gunra ransomware's Linux variant?
Yes. As of March 2026, researchers identified a weakness in the Gunra Linux Executable and Linkable Format (ELF) variants (appended with .GNRA). The encryption keys use a weak pseudorandom number generator (PRNG) seeded with the predictable system srand(time(NULL)), which may allow defenders to mathematically reconstruct the keys using file timestamps to recover files without paying the ransom.
Q&A ID 58990d01-3e54-4ecb-b7e2-3698227f38b9
What are the primary mitigation recommendations provided for organizations to protect against Gunra ransomware?
Recommended mitigations include: prioritizing the patching of known exploited vulnerabilities in internet-facing systems like VPN gateways and RDP-exposed infrastructure; implementing and testing offline, immutable backups stored in a physically separate, segmented location; segmenting networks to restrict lateral movement; requiring multi-factor authentication (MFA) for all services where possible; and disabling command-line and scripting activities and permissions.
Q&A ID f0bf959d-6dda-40dc-afc2-71d0dd72001b
What technical details are known regarding the Gunra ransomware encryption process?
The Windows encryptor uses native operating system (OS) application programming interfaces (APIs) to drive execution and targeted encryption. It utilizes the FindFirstFileW/FindNextFileW API calls to enumerate files and directories on all accessible drive letters (A through Z). The encryption uses a multi-threaded architecture with strong ChaCha20 + RSA-4096 algorithms. Once a file is encrypted, it is renamed with the .ENCRT extension (though a .CRYPT extension was used in a July 2025 sample). To avoid overhead, the binary includes filtering logic to exclude common system directories (e.g., C:\Windows) and system-critical file extensions (e.g., .exe, .dll, .sys).
Q&A ID ffff60ca-a60b-4229-b266-f832e2385928
How do Gunra ransomware actors manage their ransom negotiations?
Gunra actors demand ransom via a customized, Tor-based negotiation portal where victims are assigned a Client ID and an initial password. Victims are subsequently instructed to contact the actors via qTox, an encrypted messaging application, to negotiate payments within a five to seven day window.
Q&A ID 0df7ced1-3927-4e2e-9d4c-b7f6d2e6ffbe
What specific vulnerabilities have Gunra ransomware actors been observed exploiting for initial access?
Gunra actors have been observed exploiting known vulnerabilities in internet-facing devices, such as firewalls and VPN appliances. Specific vulnerabilities identified include CVE-2024-55591 and CVE-2025-24472, both of which are authentication bypass vulnerabilities affecting certain FortiOS and FortiProxy versions. Additionally, the Republic of Korea's National Police Agency (KNPA) observed actors exploiting credential-exposure and Secure Shell (SSH) access control vulnerabilities in internet-facing VPN gateways.
Q&A ID 170c1543-4162-476b-b544-f180fdcc43ee
What is Gunra ransomware and how does its business model operate?
Gunra is a ransomware-as-a-service (RaaS) that was used by affiliates to target government, critical infrastructure, and other organizations. It first appeared in 2025 and expanded to RaaS operations in 2026. The actors utilize a double-extortion model, which involves both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid.
Q&A ID a1196c91-c741-4bfd-b300-0ebd5188aed9
