Ransomware needs a way in. Stolen credentials are the cheapest one.
gunra Ransomware Group
Ransomware group profile
38Victims
RussiaSource country
78Impact score
Description
Gunra is a ransomware group that emerged in June 2025, primarily motivated by financial extortion. The group targets various organizations across multiple sectors by encrypting their data and threatening to publicly release stolen information if ransoms are not paid.
Key insights
- •Employs ransomware tactics to encrypt victim data.
- •Targets a wide range of sectors, including health care and legal services.
- •Utilizes ransom notes to instruct victims to pay for decryption keys through Tor-based portals.
- •Commonly leverages data leak sites to increase pressure on victims.
- •Established persistence techniques to maintain control over compromised systems.
Threat Level & Status Breakdown
For gunra · Based on incidents in selected period
2.5threat level
Aggressiveness5/ 10
Lethality0/ 10
Criticality2.6/ 10
Status Breakdown
Claimed100.0%38
First seenSep 2025
Last seenAug 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedAug 30, 2026
Recent activity
Monthly attack count for gunra in the selected period
38Total attacks
16peak in Apr
4.8avg / month
Intelligence
IOCs, YARA/Sigma rules, and related families for gunra
- c3804d1329b55a37bfa2f835e1e9bbc7bdb2b260f8e3627c06e02c9f52685d44
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- 854e5f77f788bbbe6e224195e115c749172cd12302afca370d4f9e3d53d005fd
- 77b294117cb818df701f03dc8be39ed9a361a038
- 9a7c0adedc4c68760e49274700218507
- 7dd26568049fac1b87f676ecfaac9ba0
- a82e496b7b5279cb6b93393ec167dd3f50aff1557366784b25f9e51cb23689d9
- bb79502d301ba77745b7dbc5df4269fc7b074cda
- 94f73b5dc06ba6705fcef3e759413a747049c2949a0c2e44afc03b2f9989cf73
- 944a1a411abb97f9ae547099c4834beb49de0745740ba450efb747bd62d8d83b
- 5530363373dfe8fa474c9394184d2c56a0682c6a178d6f1c3536a1a3796dff42
- 8d47d8a5d6e25c96c5e7c7505d430684
- 76f13279f2ea05c8895394f57b71716847857d2beac269272375ce8a71c80e40
- 912217b09b13e1e53f7f26335f7f84b3c3918491
- 0c3c878b678c7254446e84cca6f0d63caeb51880
- 79e19d3d8405425735e4b3cd36a8507d99dfee20
- ae6f61c0fc092233abf666643d88d0f3
- f6664f4e77b7bcc59772cd359fdf271c
- 0339269cef32f7af77ce9700ce7bf2e2
- 3178501218c7edaef82b73ae83cb4d91
- 08a3b8d6f5f386a0a86ac39b5cdcc1e5dbbf42e2
- 6d25d5c988a8cda3837dff5f294cbc25c97aea48dde1a74cba71a2439cab0a11
- 92e11df03725e29d963d44508d41a8dd
- e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d
- 22c47ec98718ab243f2f474170366a1780368e084d1bf6adcd60450a9289e4be
- 91f8fc7a3290611e28a35a403fd815554d9d856006cc2ee91ccdb64057ae53b0
- be6ee00fa5284ee4237f877f4bd5cfa871fdc6ef
- 8404521cf2a53de3459a75ff946873c43211afb6
- 94b68826818ffe8ceb88884d644ad4fc
- 844e3b0d066e7da30e704be770c26e5e
- c07b712a984a506042ea2cf6e193f20c
- 64049e058f3414066b1b68f84306ec307670b4e93543888b6e40d8e18b74b718
- f88044f60728b037c5a6e8a2f1443dae779b0cd8
- 4c0e74e9f94dff611226cd1619cb1e1d
- 6d59bb6a9874b9b03ce6ab998def5b93f68dadedccad9b14433840c2c5c3a34e
- a7703d68e4ae4ada31fd1fb01c4169d8da56e4b7
- 136e0bf4e5fe4d4249fe9570153a0b97
- 186c77101c027a465b14cb4a74f8381e
- 182024fc6c5fe0b1b33fdd9c7c37e368
- 0909ecc86f8a89831c9c229de91b829aba6cb54685a2478f89cc04376b13488e
- 333b88066da20c147309a52b8db07379f7da9d6d
- 5677dfad26045e271272bc98be2fd24e2f6d13737850ab1d9857fd58de05e9f9
- b75596415398073aa4c050cdc2f83861b8b90ee1
- eb46dfb4f15000a7d4af040b68e541251fd5716d2a77958b471a17ce2960416f
- 075dcc323259d84297e3699768c0519cc4796868
- 75cb7eb79a5fa0d388547520c6c452c700d38659080be074d70395729a0b578e
- 6faef3ca4e9ad30d736cd3716e116e040955b322
- eae09889399fe4fb8e78b114dba0527de913d12fb1802944a88ed136e3e90577
- ece1da406b5d21d5e1fd9643f5ca3794
- 02142f0a26256f9ab6f1bff156ebcaee3f39b41e
- f43287c776d40474558de39869ab279e6d6328f62576b2fd0dc837df89298c09
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for gunra
CVE-2025-24472
CVE-2024-55591
CVE-2024-5559
Other
T1486
T1486
T1490
T1490
T1562
T1562
T1047
T1047
T1059
T1059
T1078
T1078
T1547
T1547
T1021
T1021
T1080
T1080
Victims(38)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| BOMOHSA | Honduras | Claimed | 13 days ago | |
| All Cosmos Industries Sdn. Bhd | Indonesia | Claimed | 26 days ago | |
| 월드튜브 | South Korea | Claimed | 27 days ago | |
| Sakai Chemical Industry | Thailand | Claimed | about 1 month ago | |
| Weilhotel | Malaysia | Claimed | about 1 month ago | |
| Dissinger and Dissinger | United States | Claimed | about 2 months ago | |
| New Tiles | Spain | Claimed | about 2 months ago | |
| Pirámide Seguros | Venezuela | Claimed | 2 months ago | |
| on-us | Hong Kong | Claimed | 2 months ago | |
| Yuditec | Uruguay | Claimed | 2 months ago | |
| MHE9 | Brazil | Claimed | 3 months ago | |
| Suárez&Clavera | Uruguay | Claimed | 3 months ago | |
| findyello | Bahamas | Claimed | 3 months ago | |
| STAREMPIRE | Vietnam | Claimed | 3 months ago | |
| SOMAFIX | France | Claimed | 3 months ago | |
| Cablematic | France | Claimed | 3 months ago | |
| 方達金融集團 | Hong Kong | Claimed | 5 months ago | |
| EBC Contracting | United Arab Emirates | Claimed | 5 months ago | |
| Thai Petroleum & Trading Co., Ltd. | Thailand | Claimed | 5 months ago | |
| Grupo PyD | Spain | Claimed | 5 months ago |
Page 1 of 2
Affected countries(37)
Countries where this group has been reported to target or leak victims.
🇦🇪United Arab Emirates🇦🇷Argentina🇦🇺Australia🇧🇷Brazil🇧🇸Bahamas🇨🇦Canada🇨🇴Colombia🇨🇺Cuba🇨🇿Czech Republic🇩🇪Germany🇪🇬Egypt🇪🇸Spain🇫🇷France🇬🇧United Kingdom🇭🇰Hong Kong🇭🇳Honduras🇭🇷Croatia🇮🇩Indonesia🇮🇹Italy🇯🇵JapanKorea, Republic of🇱🇨Saint Lucia🇱🇹Lithuania🇲🇾Malaysia🇳🇬Nigeria🇳🇮Nicaragua🇵🇦Panama🇵🇱Poland🇸🇦Saudi Arabia🇸🇬Singapore🇹🇭Thailand🇹🇷TurkeyTaiwan, Province of China🇺🇸United States🇺🇾UruguayVenezuela, Bolivarian Republic of🇻🇳Vietnam