Gunra Ransomware Decryption & Data Recovery

Gunra surfaced in April 2025, with the first victim posted to its leak site dated 7 April 2025. On 10 August 2026 the FBI, CISA, DC3, NSA, the US Secret Service and the Korean National Police Agency published joint #StopRansomware advisory AA26-222A, stating that Gunra is "derived from the leaked Conti ransomware source code". That lineage is at the code level: the leaked Conti source has been reused by several crews, and there is no public evidence that the original Conti operators are behind Gunra.

The operation has visibly matured. It began as a self-operated double-extortion crew - modest in volume but consistent in tempo. From January 2026 it launched a formal RaaS affiliate programme on dark-web forums, offering a management panel, a configurable encryptor builder, cross-platform payloads and operator documentation, while recruiting penetration testers as initial access brokers under aliases such as "Golden Community". That shift drove both its 2026 victim growth and the widening of its target space.

Leak-site tracking puts the cumulative total at roughly 54 named victims across 28 countries by early September 2026, with new postings still appearing that month. South Korea, Brazil, Spain, Uruguay and Thailand lead by geography; manufacturing, professional services and healthcare lead by sector, with technology, finance, transportation, government, utilities, academia, media and retail also represented. Trend Micro's Linux-variant analysis adds that its telemetry detected Gunra activity at enterprises in Turkiye, Taiwan, South Korea and the United States.

What matters for enterprises is how ordinary the entry points are: unpatched Fortinet edge appliances, internet-facing SSL-VPN portals without lockout policies, and stolen SSH or VPN credentials. No public report confirms a targeted Gunra campaign against mainland China organisations, but overseas subsidiaries and cross-border branches sit squarely inside its reach.

Extensions. The Windows encryptor appends .ENCRT to the full original filename, so report.xlsx becomes report.xlsx.ENCRT; .CRYPT was documented in a July 2025 sample; CISA records .GNRA for Linux/ELF builds. An important caveat: the extension is not a proxy for the platform - the Linux variant Trend Micro analysed in July 2025 also appended .ENCRT, and .GNRA is what was observed on later ELF builds. Treat the extension as a first signal only; whether any key-reconstruction option exists depends on the encryptor build. Preserve filenames exactly and do not rename samples.

Ransom note. On Windows, R3ADM3.txt is dropped in every affected directory. The English text supplies a per-victim ID plus a Tor negotiation portal address and sets a five to seven day window. One trap is worth flagging: the Linux variant drops no note at all and simply encrypts. Encrypted files with no note on a Linux host - whether .GNRA or .ENCRT - are not evidence of a different family or a failed run.

Negotiation and leak site. The portal runs on Tor with a chat-like interface. The leak site has rotated .onion addresses since it appeared in April 2025 - the CISA advisory records a move to a different address by March 2026 - and a clearnet mirror, datapub.news, was used in June-July 2025. An organisation appearing there with a sample data pack confirms exfiltration already happened.

Surrounding artefacts.

• A suspicious backdoor account named forticloud-sync on the perimeter firewall.
• Staging or execution traces of Rclone, Mega, FileZilla, 7-Zip/WinRAR, DBeaver, MobaXterm, AnyDesk, Google Remote Desktop, Impacket (psexec.py, smbclient.py, secretsdump.py), Mimikatz and Sliver.
• Volume shadow copies deleted one by one through WMIC.

Bottom line. .ENCRT together with R3ADM3.txt is enough to attribute the family, but recoverability depends on the specific encryptor build, so a real sample must be analysed before any claim is made.

Gunra's intrusion path concentrates on the internet-facing perimeter. Nothing about it is novel, but it lands reliably against organisations whose edge devices lag on patching.

• Known edge-device vulnerabilities. The CISA advisory names CVE-2024-55591 and CVE-2025-24472, authentication bypass flaws in FortiOS and FortiProxy, used to obtain firewall administration directly.
• VPN gateway credential exposure. Credentials stored in the clear or weakly protected on SSH-reachable VPN gateways.
• Default credentials and missing lockout. SSL-VPN appliances left with default administrative accounts and no failed-login lockout, brute-forced straight through.
• Persistence. A super-admin backdoor account named forticloud-sync, with a hard-coded password, created on the Fortinet appliance so access survives cleanup.
• Lateral movement. SMB and RDP across the internal network, with Impacket (psexec.py, secretsdump.py) and Mimikatz for domain credentials; AnyDesk and Google Remote Desktop serve as fallback remote-control channels.
• Exfiltration. Rclone, FileZilla, Mega and a purpose-built tool for OneDrive/SharePoint move data out before encryption; DBeaver, MobaXterm and Amass support database access and asset discovery.

Two operational consequences follow. First, the firewall and VPN are themselves forensic evidence - export configuration, account changes and authentication logs before resetting anything. Second, exfiltration precedes encryption, so scoping the data breach cannot wait until restoration finishes.

Algorithms. File content is encrypted with the ChaCha20 stream cipher; each per-file symmetric key is wrapped with an RSA-4096 public key. Key material is never written in cleartext, so absent the operators' private key - or a flaw in key generation - there is nothing to reverse.

Windows variant. Written in C/C++ with an IsDebuggerPresent anti-debug check. Volume shadow copies are deleted one at a time through WMI, using commands of the form cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{guid}'" delete, which is why System Restore and "Previous Versions" are typically unavailable afterwards.

Linux/ELF variant. Trend Micro's July 2025 analysis shows a build optimised for speed and configurability: the same RSA plus ChaCha20 scheme applied in 1MB chunks, with a randomly generated 32-byte ChaCha20 key, 12-byte nonce and 256 bytes of padding. It supports up to 100 concurrent encryption threads (BERT, by comparison, caps at 50). Command-line arguments select the target path, thread count and an extension list (or all); --exts=disk targets block devices directly and --store points at a separate keystore file.

Intermittent encryption. The Linux variant exposes -r/--ratio and -l/--limit, letting the operator decide how much of each file gets encrypted. This matters enormously for recovery assessment: where operators traded coverage for speed, large database files, virtual disks and mail stores may retain substantial untouched regions that structural repair can exploit. The ratio is chosen by the attacker at deployment, so it has to be measured on the actual files rather than assumed.

Assets hit. The CISA advisory records deliberate encryption of key assets including database servers and network attached storage (NAS), which is what turns an incident into an extended outage. As of now, no reliable public source confirms a dedicated VMware ESXi encryptor for Gunra.

Double extortion. Data is stolen before encryption; if the five to seven day window passes without engagement, it is published in stages on the Tor leak site.