Researchers Analyze Gunra Ransomware After Infiltrating Its Affiliate Program
Summary
CloudSEK says it infiltrated Gunra’s newly launched affiliate program and analyzed a Windows ransomware sample that uses ChaCha20 and RSA-4096, encrypts selected files offline, and leaves R3ADM3.txt ransom notes.
Key points
- CloudSEK researchers reported discovering Gunra’s affiliate program on a dark web forum in January 2026 and obtaining panel credentials, an operator guide, and a ransomware sample through HUMINT operations.
- The analyzed Windows sample scans drives A–Z, skips specified system directories and file extensions, and targets other files, renaming encrypted files with the .ENCRT extension.
- It generates a unique ChaCha20 key and nonce for each file, then protects the key material with an embedded RSA-4096 public key.
- The sample uses worker threads for parallel file processing and writes R3ADM3.txt ransom notes in directories containing encrypted files.
- Researchers observed no DNS, HTTP, or socket activity during encryption; victims are directed to contact the attackers through a Tor portal after encryption.
- CloudSEK recommends offline or immutable backups, application allowlisting, endpoint monitoring for mass file changes and ransom notes, and tested incident response plans.
Article Details
- Attack Vectors
- Gunra affiliates deploy ransomware binaries that recursively scan accessible drives and encrypt files.
- The ransomware is distributed to affiliates through a Ransomware-as-a-Service program with a management panel and configurable locker builder.
- The ransom note directs victims to a Tor payment portal; the article reports that portal interaction is victim-driven after encryption.
- Defensive Notes
- Maintain frequent offline and immutable backups, and regularly test restoration procedures.
- Enforce application allowlisting and prevent execution from user-writable directories.
- Monitor for suspicious file activity, including .ENCRT file extensions, ransom-note creation, and high-volume file modifications.
- Apply phishing protection, enforce multi-factor authentication, and educate users on safe file handling.
- Maintain a tested ransomware response plan, prepare to isolate systems rapidly, and preserve forensic evidence.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | e57b130718373f6ba9b37f39ca1d7e3d | MD5 hash identified as the ransomware locker file. |
| SHA256 | 25c8cb27947042de89d634b3e260e614e5b1425a89494fa4e4295bcabfa8ee48 | SHA-256 hash identified as the operator PDF guide. |
| SHA256 | 75e5621756e9d19efeac2bcbb2ac4711fb85243c03b0a19c05b18e31a780691e | SHA-256 hash identified as the ransomware locker file. |
MITRE ATT&CK
T1005 · Data from Local SystemThe ransomware targets user documents and other files on local drives for encryption.T1036.003 · Rename Legitimate UtilitiesEncrypted files are renamed with the .ENCRT extension.T1083 · File and Directory DiscoveryThe ransomware recursively scans drives A–Z and enumerates files and directories.T1104 · Multi-Stage ChannelsThe article maps the victim's post-encryption access to the Tor payment portal to this technique.T1204 · User ExecutionThe article maps victim execution of the ransomware binary to this technique.T1486 · Data Encrypted for ImpactThe ransomware encrypts files using ChaCha20 and protects encryption keys with RSA-4096.T1491 · DefacementThe ransomware places a R3ADM3.txt ransom note in directories containing encrypted files.T1564 · Hide ArtifactsThe article maps the ransomware's exclusion of Windows and other system directories to this technique.T1657 · Financial TheftThe ransomware operation demands payment from victims.
Threat Actors
Malware
Products
ESXiCross-Platform Support: The ransomware targets Windows, Linux, ESXi, and NAS environments across multiple architectures, including x86 and ARM.LinuxCross-Platform Support: The ransomware targets Windows, Linux, ESXi, and NAS environments across multiple architectures, including x86 and ARM.Microsoft WindowsGunra is a sophisticated ransomware operation primarily targeting Windows systems. It features a fully-featured affiliate management panel, configurable attack parameters, and advanced encryption capabilities. TheNASCross-Platform Support: The ransomware targets Windows, Linux, ESXi, and NAS environments across multiple architectures, including x86 and ARM.