RansomwareHigh for the joint advisory's operation-level Gunra attribution, observed intrusion mechanics, and published IOCs. Named human operators, state sponsorship, universal affiliate behavior, and a complete victim population are not established. confidenceSynced actor recordProfile updated 2026-08-11T14:00:00.000Z

Gunra

Gunra emerged in April 2025 as Conti-derived double-extortion ransomware and formalized a RaaS affiliate program in January 2026. The August 10, 2026 joint U.S./Republic of Korea advisory adds government-observed Fortinet edge exploitation, credential and session theft, MFA bypass, cloud and server data exfiltration, Windows/Linux encryption, and recovery destruction.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.

Actor Card Detail

Canonical Profile Fields

Entity Type¹

Ransomware profile

First Seen¹

2025-04-01

Last Seen¹

2026-08-10

Profile Updated¹

2026-08-11T14:00:00.000Z

Victim Count^1,2

Not available

Origin¹

Unknown

Motivation¹

Financially motivated ransomware-as-a-service and double extortion

Primary Access Pattern¹

T1190 Exploit Public-Facing Application

Objective¹

Financially motivated ransomware-as-a-service and double extortion

Identity

Aliases And Boundaries

Aliases¹

Gunra RansomwareGolden Community

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure^1,2

Not available

Target Sectors^1,2

GovernmentHealthcareFinancial ServicesInsuranceManufacturingConstructionTransportationLogisticsUtilitiesAcademiaMediaCommunicationsRetailProfessional ServicesNonprofitsConstruction of BuildingsFood ManufacturingOther Information ServicesRail TransportationSoftware PublishersReal EstateHospitalsElectrical Equipment, Appliance, and Component ManufacturingPublic AdministrationOil & GasBeverag & Tobacco ManufacturingEducational ServicesWholesale TradeRestaurantsEnergy & UtilitiesPharmaceutical and Medicine ManufacturingPlastics Product ManufacturingAircraft ManufacturingLegal ServicesManagement, Scientific, and Technical Consulting ServicesPersonal Care ServicesMedical Equipment and Supplies ManufacturingJewelry StoresResearch and Development in the Social Sciences and HumanitiesAdvertising AgenciesFacilities Support ServicesJustice & Safety ActivitiesAccommodation&Food ServicesChemical&Pharmaceutical ManufacturingNational Security&International AffairsTruck&Rail TransportationTransportation&WarehousingAgriculture&ForestryElectrical&Electronical ManufacturingSea TransportationInformation ServicesComputer Design & ServicesBankingOtherFinanceE-CommerceProfessional&Technical ServicesHealthCare & Social AssistanceRental & LeasingAdministrative & Support ServicesJanitorial ServicesNational SecurityOffices of Certified Public AccountantsOffices of LawyersComputer Systems Design Services

Associated Activity¹

forticloud-sync superusermain.execryptor.exemsmp.exeR3ADM3.txt.ENCRT files.CRYPT filesAA26-222A IP/domain/STIX setImpacket or RDP/SMB lateral movementOneDrive or SharePoint collectionMega, RClone, or FileZilla exfiltrationShadow-copy or backup deletionExecution: Files appended with the '.encrt' extension.Execution: Presence of a ransom note file named 'r3adm3.txt'.Defense Evasion: Deletion of shadow copies via Windows Management Instrumentation (WMI) commands.Execution: Running processes associated with 'gunraransome.exe'.Defense Evasion: Attempts to detect debuggers or analysis environments using APIs like IsDebuggerPresent.Defense Evasion: Process injection or manipulation using GetCurrentProcess and TerminateProcess.Discovery: Usage of Windows API functions like FindNextFileExW and FindNextFileW for file enumeration and network scanning.Defense Evasion: Stopping or disabling backup and anti-virus related services.Command and Control: Network traffic or connections to Tor-based .onion addresses.

ATT&CK IDs¹

T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1003 OS Credential DumpingT1021 Remote ServicesT1530 Data from Cloud StorageT1560 Archive Collected DataT1567 Exfiltration Over Web ServiceT1486 Data Encrypted for ImpactT1490 Inhibit System Recovery

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported 849²IntelliOS retained 56^{1,8,9,10,11,12}

SOCRadar reports 849 IOCs for this profile. IntelliOS currently retains 56 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 9 source groups tracked; 8 currently contribute retained observable or context rows.

Retained Observables

Showing 56 of 56

Type	Value	Source
File Extension	.ENCRT¹⁰	ANY.RUN
Tool / Process	Anti-debugging¹⁰	ANY.RUN
Tool / Process	Cross-platform ransomware variant⁸	Trend Micro
Tool / Process	Data leak site pressure¹⁰	ANY.RUN
Tool / Process	Double extortion¹⁰	ANY.RUN
Tool / Process	File enumeration¹⁰	ANY.RUN
Tool / Process	Five-day payment ultimatum¹⁰	ANY.RUN
Tool / Process	Gunra ransomware¹⁰	ANY.RUN
Tool / Process	Linux encryptor⁸	Trend Micro
Tool / Process	Process injection¹⁰	ANY.RUN
Tool / Process	Ransom note workflow¹⁰	ANY.RUN
Tool / Process	Shadow-copy deletion¹⁰	ANY.RUN
Tool / Process	Targeted directory encryption¹⁰	ANY.RUN
ATT&CK ID	T1027 - Obfuscated Files or Information¹⁰	ANY.RUN
ATT&CK ID	T1055 - Process Injection¹⁰	ANY.RUN
ATT&CK ID	T1059 - Command and Scripting Interpreter¹⁰	ANY.RUN
ATT&CK ID	T1059.004 - Unix Shell¹⁰	ANY.RUN
ATT&CK ID	T1083 - File and Directory Discovery¹⁰	ANY.RUN
ATT&CK ID	T1140 - Deobfuscate/Decode Files or Information¹⁰	ANY.RUN
ATT&CK ID	T1486 - Data Encrypted for Impact¹⁰	ANY.RUN
ATT&CK ID	T1489 - Service Stop¹⁰	ANY.RUN
ATT&CK ID	T1490 - Inhibit System Recovery¹⁰	ANY.RUN
ATT&CK ID	T1562.001 - Disable or Modify Tools¹⁰	ANY.RUN
ATT&CK ID	T1567 - Exfiltration Over Web Service¹⁰	ANY.RUN
ATT&CK ID	T1657 - Financial Theft¹⁰	ANY.RUN
Alias / Related Name	Gunra	Retained source
Malware Family	Gunra ransomware⁸	Trend Micro
Campaign Context	ANY.RUN is retained for malware-behavior context, including anti-debugging, process injection, shadow-copy deletion, .ENCRT extension, and file-enumeration behavior.¹⁰	ANY.RUN
Campaign Context	CYFIRMA is retained for high-level actor profile, sector risk, and double-extortion context.⁹	CYFIRMA
Campaign Context	Industrial Cyber and CyberMaterial are retained as secondary context sources and should not expand Gunra victimology beyond cited public claims.	Retained source
Campaign Context	IntelliOS treats Gunra as an emerging double-extortion ransomware profile with Linux/cross-platform expansion and explicit caution around victimology claims.⁸	Trend Micro
Campaign Context	Lumu and SOC Prime are retained as defensive/detection-context sources, not as raw actor-identity authorities.¹¹	Lumu
Campaign Context	SOCRadar imports Gunra as a ransomware row; IntelliOS uses that baseline and adds Trend Micro, CYFIRMA, ANY.RUN, Lumu, SOC Prime, Industrial Cyber, and CyberMaterial context.	Retained source
Campaign Context	Trend Micro is retained as the controlling technical source for Gunra's Linux variant and cross-platform encryption behavior.⁸	Trend Micro
COUNTRY	Argentina¹⁰	ANY.RUN
COUNTRY	Egypt¹⁰	ANY.RUN
COUNTRY	Global ransomware victimology⁹	CYFIRMA
COUNTRY	Italy¹⁰	ANY.RUN
COUNTRY	Japan¹⁰	ANY.RUN
COUNTRY	Panama¹⁰	ANY.RUN
OBSERVABLE	ANY.RUN reports Gunra endpoint behavior including anti-debugging, process injection, shadow-copy deletion, file enumeration, encryption, and .ENCRT extension use.¹⁰	ANY.RUN
OBSERVABLE	CyberMaterial is retained as a compact profile source for Gunra metadata and high-level defensive context.	Retained source
OBSERVABLE	CYFIRMA profiles Gunra as a double-extortion ransomware actor targeting multiple sectors and using aggressive pressure tactics.⁹	CYFIRMA
OBSERVABLE	Industrial Cyber syndicates CYFIRMA's critical-infrastructure warning; IntelliOS retains it as secondary sector-context reporting only.	Retained source
OBSERVABLE	Lumu summarizes Gunra's strict five-day ultimatum and critical-industry risk context; IntelliOS retains this as pressure-tactic context, not a raw negotiation artifact.¹¹	Lumu
OBSERVABLE	SOC Prime retains Gunra detection logic context for double-extortion behavior and malicious activity patterns.¹²	SOC Prime
OBSERVABLE	Trend Micro analyzed a Gunra Linux variant that accelerates and customizes encryption, expanding the group's reach into Linux and cross-platform environments.⁸	Trend Micro
RANSOM_NOTE	Ransom note / five-day ultimatum reporting context¹¹	Lumu
REGION	Global ransomware victimology with reported Japan, Egypt, Italy, Panama, and Argentina exposure¹⁰	ANY.RUN
SECTOR	Critical infrastructure reporting context⁹	CYFIRMA
SECTOR	Cross-platform enterprise environments⁹	CYFIRMA
SECTOR	Healthcare⁹	CYFIRMA
SECTOR	Linux server environments⁸	Trend Micro
SECTOR	Manufacturing⁹	CYFIRMA
SECTOR	Pharmaceuticals⁹	CYFIRMA
SECTOR	Real estate⁹	CYFIRMA

Source	Reported	Retained	Coverage Status
SOCRadar²	849	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.
SOCRadar¹	N/A	2	Public observables or source-context rows retained and displayed.
Trend Micro⁸	N/A	7	Public observables or source-context rows retained and displayed.
CYFIRMA⁹	N/A	9	Public observables or source-context rows retained and displayed.
ANY.RUN¹⁰	N/A	31	Public observables or source-context rows retained and displayed.
Lumu¹¹	N/A	3	Public observables or source-context rows retained and displayed.
SOC Prime¹²	N/A	1	Public observables or source-context rows retained and displayed.
Industrial Cyber	N/A	2	Public observables or source-context rows retained and displayed.
CyberMaterial	N/A	1	Public observables or source-context rows retained and displayed.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Gunra	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Gunra	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor/ransomware	Baseline actor-card corpus source for retained profile fields.
2	SOCRadar Actor Profile https://socradar.io/free-tools/ransomware-intelligence/groups/gunra	Per-actor SOCRadar profile source for ransomware profile metadata and IOC count when available.
3	Gunra Ransomware: Edge Exploitation and Cross-Platform Extortion /vault/gunra-ransomware-edge-exploitation-campaign	IntelliOS Flash Threat Brief
4	Gunra RaaS Edge-Exploitation Campaign /threat-actor-cards/campaigns/gunra-raas-edge-exploitation	CARDS Campaign
5	CISA/FBI/Partners: #StopRansomware Gunra https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a	Joint Government Advisory
6	AhnLab: Gunra Ransomware Emerges with New DLS https://asec.ahnlab.com/en/89206/	Primary Malware Research
7	S2W: Gunra RaaS expansion https://s2w.inc/en/resource/detail/1057	RaaS Research
8	Trend Micro: Gunra ransomware Linux variant https://www.trendmicro.com/en_us/research/25/g/gunra-ransomware-linux-variant.html	Threat Research
9	CYFIRMA: Gunra ransomware brief analysis https://www.cyfirma.com/research/gunra-ransomware-a-brief-analysis/	Threat Research
10	ANY.RUN: Gunra malware overview https://medium.com/@anyrun/gunra-malware-overview-5e79efa06a8f	Malware Analysis
11	Lumu: Gunra five-day ultimatum advisory https://lumu.io/blog/advisory-alert-gunra-ransomware-5day-ultimatum/	Threat Advisory
12	SOC Prime: Detect Gunra ransomware https://socprime.com/blog/detect-gunra-ransomware/	Detection Content

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Gunra.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Loading Threat Actor Cards