First seen on dark-web leak sites in April 2025, Gunra moves with blistering speed, pressuring victims to negotiate within five days and threatening public data dumps to multiply the pain. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. ASEC analysts noted that more than a dozen enterprises across manufacturing, healthcare, and logistics reported interruptions traced to Gunra in its first three months of activity. Endpoint defenses must therefore monitor abnormal thread fan-out and aggressive WMIC shadow-copy deletions to spot Gunra before backups vanish. The recently uncovered Gunra ransomware is the family to weaponize leaked Conti source code, unleashing rapid-fire double-extortion attacks against Windows endpoints worldwide. Crucially, the Trojan skips executable, driver, and system files to preserve OS stability, ensuring victims can still read the ransom note “R3ADM3.txt” left in every directory. Once administrative footholds are secured, the malware is pushed to dozens of machines in minutes via PsExec or Group Policy, triggering simultaneous encryption that hobbles business operations. Internally, the strain mirrors Conti’s multithreaded model: it spawns as many encryption threads as there are logical CPU cores, maximizing disk throughput while minimizing dwell time. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Unlike spray-and-pray spam campaigns, the operators favor hands-on intrusion, typically breaching networks through stolen RDP credentials or unpatched VPN gateways before pivoting laterally to domain controllers. At launch, Gunra creates a unique mutex, then calls GetNativeSystemInfo to size its thread pool. Each thread generates an RSA-2048 key embedded in the binary to derive a ChaCha20 session key for file scrambling, then appends the “.ENCRT” extension.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 25 Jul 2025 12:15:17 +0000