Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained

Umut Bayram | 9 MIN READ

LAST UPDATED ON AUGUST 12, 2026

Key Takeaways

Gunra is a ransomware-as-a-service family built on leaked Conti source code, first seen in April 2025.
Windows and Linux variants encrypt files using ChaCha20 with RSA-4096 and append the .ENCRT extension.
Initial access exploits FortiOS authentication bypasses CVE-2024-55591 and CVE-2025-24472 to create persistent superuser accounts.
Affiliates exfiltrate documents, databases, and internal email to cloud services, with volumes reaching tens of terabytes.
The Picus Platform simulates Gunra attacks and validates prevention signatures across existing preventive security controls.

Gunra is a ransomware-as-a-service (RaaS) family that first appeared in April 2025. It is built on the Conti ransomware source code leaked in 2022, and it encrypts both Windows and Linux systems using ChaCha20 with RSA-4096.

It targets government, critical infrastructure, healthcare, financial services, and nonprofit organizations across the Americas, Europe, the Middle East, Africa, and Asia-Pacific.

The Linux encryptor is a command-line tool the operator drives entirely through arguments. It runs up to 100 encryption threads at once, lets the affiliate pick which extensions to hit and how much of each file to encrypt, and can write per-file key material to separate keystore files instead of appending it to your data.

In this blog, we explain how Gunra ransomware operates at each stage of its execution flow, and show how Picus validates your security controls against this threat.

Gunra Ransomware at a Glance

Attribute	Detail
Aliases	Gunra, Golden Community
Malware type	Ransomware-as-a-service (RaaS), double extortion
First seen	April 2025 on Windows. Linux variant reported July 2025. RaaS program launched January 2026
Lineage	Built on the Conti source code leaked in 2022
Target platform	Windows and Linux
Encryption scheme	ChaCha20 with RSA-4096
Initial access CVEs	CVE-2024-55591 and CVE-2025-24472
Regions affected	Americas, Europe, Middle East, Africa, and Asia-Pacific

What Is Gunra Ransomware?

Gunra is a double-extortion ransomware family. It was first seen in April 2025 hitting Windows environments. A Linux variant surfaced in mid-2025, and in January 2026 the operators opened a formal RaaS affiliate program on dark web forums. The FBI has also seen the group operate under a second brand, Golden Community [2].

Gunra does three things:

Steals first: Affiliates collect documents, databases, personally identifiable information (PII), and internal email, then move it to cloud file-sharing services before they deploy the encryptor.
Encrypts fast: The encryptor runs many files in parallel using ChaCha20 with RSA-4096 and renames what it touches with the .ENCRT extension.
Extorts twice: Victims get pushed to a Tor negotiation portal and threatened with publication or resale of their data.

Affiliates buy a complete package: a management panel, a configurable ransomware builder, cross-platform locker payloads, and written affiliate documentation. The group also recruits penetration testers and ethical hackers as initial access brokers and pays them a cut of the ransom.

How Does Gunra Ransomware Work?

Gunra runs the same play from one victim to the next, moving from an exploited edge device to a fully encrypted network. The subsections below follow that execution flow in order.

Initial Access

Gunra actors get in by exploiting known vulnerabilities in internet-facing devices, mostly firewalls and VPN appliances. Two FortiOS and FortiProxy authentication bypasses show up in FBI reporting [2]:

CVE-2024-55591
CVE-2025-24472

Both let an attacker abuse scheduled tasks on a vulnerable FortiOS firewall to create a persistent superuser account called forticloud-sync with a hard-coded password.

Persistence, Privilege Escalation, and Lateral Movement

Gunra actors reuse legitimate remote services instead of dropping custom implants. They run the Impacket libraries psexec.py and smbclient.py to move over Server Message Block (SMB). They also pull OpenSSH from an attacker-controlled server to tunnel between compromised hosts and stay in the network.

They keep access through account manipulation. After landing on a network administrator's workstation, they opened the SSL-VPN admin console, found an unused account that could reach both the internet-facing and internal networks, and changed its configuration to skip the mandatory password change. They then used that account freely.

With stolen session data, they moved into the internal virtual desktop infrastructure (VDI) environment and pivoted over Remote Desktop Protocol (RDP) to the VDI authentication web server, the internal Active Directory (AD) server, and IT staff virtual desktops [2].

Credential Access

Gunra goes after reusable authentication material at every turn.

NTDS dumping: The FBI saw secretsdump.py, another Impacket library, run against compromised domain controllers to pull password hashes from the NT Directory Services (NTDS) file. That gave them pass-the-hash and pass-the-ticket access to other privileged systems.
MFA backdoor: They edited authentication processing files on the VDI portal server so one attacker-chosen one-time password (OTP) always worked. That gave them a permanent way around multi-factor authentication (MFA).
Password store theft: From a compromised virtual desktop, they reached a Hiware system access control server over SSH and stole the symmetric encryption key sitting on it. That key decrypted enterprise server account passwords in the database and let them dump credentials for every enterprise server [2].

Collection and Exfiltration

The FBI documented the collection of business-critical documents, databases, PII, and internal email.

For cloud data, the actors run an executable named main.exe to pull files out of Microsoft OneDrive and SharePoint. At one known victim, they packed data into compressed archives and shipped it to the file-sharing service Mega. Exfiltrated volumes have reached tens of terabytes. In May 2025, the group claimed it took 40 terabytes from a hospital in Dubai [1].

Open source tools seen on Gunra infrastructure include 7-Zip, WinRAR, RClone, and FileZilla for collection and exfiltration.

Inhibiting System Recovery

Gunra removes your recovery options before it encrypts. The binary carries Windows Management Instrumentation (WMI) commands and runs them through cmd.exe to delete volume shadow copies

:: Delete a specific volume shadow copy by GUID so files cannot be rolled back after encryption

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{guid of shadowcopy}'" delete

At one victim, the actors went further. They deleted backup and archived data on backup infrastructure at both the primary data center and the disaster recovery center, before and after they deployed the ransomware [2].

Encryption

Gunra ransomware can target both Windows and Linux with different variants.

Encryption on Windows

The Windows encryptor uses native OS APIs for both execution and targeting. It calls FindFirstFileW and FindNextFileW to enumerate files and directories on every accessible drive letter.

Encryption runs across multiple threads, handling several files at once with ChaCha20 and RSA-4096. Encrypted files get the .ENCRT extension. Once a directory is done, the actors write a static ransom note named R3ADM3.txt into it.

Encryption on Linux

Every part of the Linux variant comes from the arguments the operator passes at runtime.

Here are the remarkable arguments:

-t, --threads number of threads to use, capped at 100

-e, --exts file extensions to process ("all" encrypts everything found)

-r, --ratio ratio of encryption, which enables partial encryption

-l, --limit encryption limit in GB. If 0, encrypt the entire file

It works multi-threaded. A waiting loop keeps the process alive until every thread finishes. It polls the shared counter every 10 milliseconds [1]:

while ( 1 )

{

pthread_mutex_lock(&thread_count_mutex); // wait for all encryption threads to complete before exiting

v122 = current_thread_count;

pthread_mutex_unlock(&thread_count_mutex);

if ( !v122 )

break;

usleep(10000); // re-check every 10 ms

}

This variant needs a path to a PEM file holding an RSA public key. For each file it generates fresh material: a random 32-byte ChaCha20 key, a 12-byte nonce, and 256 bytes of padding. It then parses the public key out of the PEM file and RSA-encrypts that material [1].

generate_rand(v72, 32); // ChaCha20 key

generate_rand(v82, 12); // nonce

generate_rand(v73, 256); // padding

memset(v76, 0, 1028);

parse_pem_public_key_from_file(a3, v76);

v89 = rsa_public_encrypt(v74, &v81, v73, 256u, v76); // wrap the ChaCha20 material under the operator's RSA public key

memset(v73, 0, 256); // clear the plaintext material from memory

File data goes through the ChaCha20 stream cipher in 1 MB chunks. --ratio drives partial encryption by skipping content between encrypted chunks.

Encrypted files get .ENCRT appended.

How Picus Simulates Gunra Ransomware Attacks

We strongly suggest simulating Gunra Ransomware Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other ransomware variants, such as Warlock, BlackCat, Black Basta, and Akira, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the Gunra Ransomware Attacks:

Threat ID	Threat Name	Attack Module
67054	Gunra Ransomware Download Threat	Network Infiltration
71028	Gunra Ransomware Email Threat	E-mail Infiltration
57181	Gunra Ransomware Campaign	Windows Endpoint

Picus also provides actionable mitigation content. Picus Mitigation Library includes prevention signatures to address Gunra Ransomware attacks in preventive security controls. Currently, Picus Labs has validated the following signatures for Gunra Ransomware:

Security Control	Signature ID	Signature Name
Check Point NGX	0C107D910	Ransomware.Win32.Gunra.TC.deb9PGKp
Check Point NGX	0CC054965	Ransomware.Win32.Gunra.TC.0c7epQvQ
Check Point NGX	0BE38EF75	Ransomware.Win32.Gunra.TC.2a85kGlo
Check Point NGX	0E73AD888	Ransomware.Win32.Gunra.TC.4de9tiMy
Check Point NGX	0FEB8A4C2	Ransomware.Win32.Gunra.TC.af24GzUw
Check Point NGX	0EF20244D	Ransomware.Win32.Gunra.TC.7e90iIjb
Check Point NGX	0DBAC14D6	Ransomware.Win32.Gunra.TC.2b9eNeTJ
Check Point NGX	0AE9BAA80	Ransomware.Win32.Gunra.TC.7c23nPdw
Check Point NGX	0CFBD83BB	Ransomware.Win32.Gunra.TC.b529Uwat
FortiGate AV	62183	PossibleThreat
FortiGate AV	10118502	W64/Filecoder.GV!tr.ransom
FortiGate AV	10216504	W32/GenKryptik.HJAU!tr
Trellix	0x4840c900	MALWARE: Malicious File Detected by GTI
Palo Alto NG Firewall	714526206	TrojanDownloader/Win64.bazaarloader.al
Palo Alto NG Firewall	738830700	ransomware/Linux.dsete.a
Palo Alto NG Firewall	731576679	Trojan/Win32.zusy.bjeb
Palo Alto NG Firewall	739003811	ransomware/Win32.barys.afdy
Palo Alto NG Firewall	736896933	ransomware/Win32.cerber.nth
Palo Alto NG Firewall	723469545	trojan/Win32.barys.afdw
Palo Alto NG Firewall	731834405	trojan/Win32.midie.lvt
Palo Alto NG Firewall	744842154	TrojanDownloader/Win64.bazaarloader.as
Palo Alto NG Firewall	745219267	trojan/Win32 EXE.conti.qn
Cisco Firepower	N/A	Win.Ransomware.Generic::28fq.in14.talos
Cisco Firepower	N/A	Auto.22C47E.282054.in02
Cisco Firepower	N/A	Auto.76F132.281865.in02
Cisco Firepower	N/A	Auto.91F8FC.282053.in02
Cisco Firepower	N/A	FileRepMalware:Attribute.28gm.in14.Talos
Cisco Firepower	N/A	W32.GenericKDZ:Attribute.28h2.1201
Cisco Firepower	N/A	W32.Variant:Attribute.28h2.1201
Cisco Firepower	N/A	W32.6D25D5C988-95.SBX.TG
Cisco Firepower	N/A	W32.HEUR:Gen.28lx.1201

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] “Gunra Ransomware Group Unveils Efficient Linux Variant,” Trend Micro. Accessed: Aug. 11, 2026. [Online]. Available: https://www.trendmicro.com/en_us/research/25/g/gunra-ransomware-linux-variant.html

[2] “Website.” [Online]. Available: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a

Gunra is a double-extortion ransomware-as-a-service family that first appeared in April 2025 on Windows. It is built on the Conti source code leaked in 2022 and encrypts both Windows and Linux systems using ChaCha20 with RSA-4096. A Linux variant surfaced in mid-2025, and a formal affiliate program launched in January 2026.

Gunra runs as a ransomware-as-a-service operation, and the FBI has seen the group operate under a second brand called Golden Community. Affiliates buy a management panel, a configurable ransomware builder, cross-platform locker payloads, and written affiliate documentation. The group also recruits penetration testers as initial access brokers and pays them a cut of the ransom.

Gunra targets government, critical infrastructure, healthcare, financial services, and nonprofit organizations. Victims span the Americas, Europe, the Middle East, Africa, and Asia-Pacific. In May 2025, the group claimed it took 40 terabytes of data from a hospital in Dubai.

Gunra actors exploit known vulnerabilities in internet-facing devices, mostly firewalls and VPN appliances. Two FortiOS and FortiProxy authentication bypasses appear in FBI reporting, CVE-2024-55591 and CVE-2025-24472. Both allow an attacker to abuse scheduled tasks on a vulnerable FortiOS firewall to create a persistent superuser account named forticloud-sync with a hard-coded password.

Gunra encrypts with the ChaCha20 stream cipher and wraps per-file key material under RSA-4096. The Windows encryptor enumerates files with FindFirstFileW and FindNextFileW across every accessible drive and encrypts across multiple threads. The Linux variant runs up to 100 threads, processes data in 1 MB chunks, and supports partial encryption.

Patch internet-facing firewalls and VPN appliances against CVE-2024-55591 and CVE-2025-24472 and hunt for unauthorized accounts such as forticloud-sync. Protect backups and volume shadow copies from deletion, monitor for Impacket activity and NTDS dumping, and verify that authentication and MFA configuration files have not been altered.

Yes. The Picus Threat Library includes Gunra Ransomware Download Threat (67054) in the Network Infiltration module and Gunra Ransomware Email Threat (71028) in the E-mail Infiltration module. The Picus Mitigation Library provides validated prevention signatures for Check Point NGX, FortiGate AV, Trellix, Palo Alto NG Firewall, and Cisco Firepower.