Gunra Ransomware Expands RaaS After Conti Locker Shift

Why It Matters

Gunra’s RaaS model lowers entry barriers for cyber‑criminals, enabling rapid scaling and sector‑agnostic attacks that threaten a broader range of enterprises. The lack of targeting constraints and flexible branding make detection and attribution increasingly difficult for defenders.

Key Takeaways

• Gunra shifted from Conti-based locker to independent RaaS model
• Affiliate panel lets partners brand ransomware and negotiate ransoms
• At least 32 victims confirmed by March 2026, attacks resurging
• No industry or geography restrictions increase attack surface across sectors
• Supports Windows and Linux; Linux version contains exploitable cryptographic flaws

Pulse Analysis

The ransomware landscape has long been dominated by a handful of mature families, but the emergence of Gunra signals a new tier of modular threat actors. After debuting in April 2025 with a Conti‑derived payload, the group abandoned the borrowed code in favor of a custom encryptor that runs on both Windows and Linux. This technical diversification, coupled with a dedicated affiliate portal, mirrors the business models of established RaaS outfits like REvil and LockBit, but with a lower profile that makes early detection harder.

Gunra’s affiliate ecosystem is designed for anonymity and flexibility. Operators provide a web‑based dashboard that handles victim negotiation, data exfiltration, and even allows affiliates to re‑brand the ransomware under unique names. Such white‑labeling dilutes threat‑intel signatures, forcing security teams to chase multiple variants that share a common backend. The absence of industry or geographic targeting rules means affiliates can pursue high‑value sectors—including healthcare and critical infrastructure—without internal approval, amplifying the group’s potential impact across the global economy.

Defenders must adapt by monitoring dark‑web forums where Gunra advertises its services and by hardening endpoints against both Windows and Linux payloads. Enhanced EDR rules that flag the specific encryption routines identified in the Linux variant can provide an early warning, while robust backup strategies remain essential to mitigate ransom pressure. As Gunra continues to recruit affiliates and refine its toolkit, organizations that invest in proactive threat‑hunting and incident‑response planning will be better positioned to neutralize this evolving RaaS threat.