Breakglass Intelligence's March 2026 analysis

TL;DR: Gunra is a Conti-derived RaaS operation that expanded to Linux with a compact 84KB ELF binary targeting enterprise servers. Our analysis of the x86-64 variant reveals a catastrophic cryptographic weakness: the Linux build generates ChaCha20 key material using musl-libc's rand() seeded by time() , reducing the entire keyspace to roughly 256 possible values per second of encryption activity. Files encrypted by this variant are recoverable via brute-force without paying the USD 7-10M ransom. We mapped 5 Tor hidden services (including a Windows-based Apache data leak site), identified 4 ELF builds across x86-64, i386, and two ARM architectures all uploaded to MalwareBazaar on the same day, and confirmed an active RaaS affiliate program running on the RAMP forum since January 2026.

Gunra's lineage traces directly to the Conti source code leak of March 2022. First observed in April 2025 as a Windows-only operation, the group expanded to Linux by July 2025 and has since claimed 20+ victims across 8 countries -- Brazil, Japan, Canada, Turkey, South Korea, Taiwan, Egypt, and the United States. Ransom demands consistently land in the USD 7-10 million range, with a 5-day payment deadline. In December 2025, they hit INHA University in South Korea, exfiltrating 650GB of data.

In January 2026, Gunra launched an affiliate program on the RAMP dark web forum, transitioning to a full Ransomware-as-a-Service model. The timing aligns with infrastructure expansion: five .onion domains appeared in ThreatFox on January 13, and the affiliate recruitment post went live January 15.

On March 4, 2026, four ELF samples covering every major Linux architecture landed on MalwareBazaar within the same submission window -- an operational leak that gave us a complete picture of their build system.

At 84KB with 61KB of executable code, this is remarkably compact ransomware. The entire encryption engine (ChaCha20 + RSA-4096), recursive filesystem traversal, ransom note deployment, and argument parsing fits in less code than most web page JavaScript bundles. The binary is statically linked against musl-libc, stripped of all symbols, and compiled as a position-independent executable -- designed to run on any modern Linux system without dependencies.

Gunra implements a standard hybrid encryption scheme. Each file gets a unique symmetric key, and that key is then encrypted with the embedded RSA public key and stored alongside the ciphertext.

Symmetric layer -- ChaCha20:

Asymmetric layer -- RSA-4096:

Encrypted file structure:

Encrypted files receive the .GNRA extension. A footer is appended containing the RSA-encrypted symmetric key in a structure marked by the ENCRT magic:

Additionally, .keystore files are created containing the RSA-encrypted per-file symmetric keys.

This is where Gunra's Linux variant falls apart. The Windows variant uses CryptGenRandom() -- a cryptographically secure PRNG -- to generate ChaCha20 key material. The Linux variant uses rand() from musl-libc, seeded by time() .

This is a catastrophic implementation error. The LCG produces only 15 bits of entropy per call, and since the seed is the current Unix timestamp in seconds, the entire keyspace for a given second of encryption activity is approximately 256 values. For a realistic 1-hour encryption window, there are only ~3,600 possible seed values to test.

If your organization has been hit by the Linux variant of Gunra:

The Windows variant ( .ENCRT extension) uses CryptGenRandom() and is NOT vulnerable to this attack. Only .GNRA files from the Linux ELF variant are recoverable.

Sandbox analysis reveals aggressive system modification beyond encryption:

The binary skips critical system directories to keep the host bootable:

Everything else -- / , /var , /opt , /root , /mnt , /media -- is fair game. This is data-targeted ransomware: it encrypts your files while keeping the OS functional enough for you to read the ransom note and navigate to the Tor portal.

Each build ships with a unique Client ID and password, confirming per-victim binary customization.

The filename pattern build_ .bin points to an automated build pipeline that generates per-victim or per-affiliate binaries with unique RSA keypairs and negotiation credentials.

Five samples from this family have been identified:

All four ELF samples appeared on the same day, suggesting either a batch build for a specific campaign or a development/testing upload by the operator. The ARM variants (two of them, at different sizes) indicate targeting of embedded Linux systems, NAS devices, or IoT infrastructure -- environments where ARM processors are dominant.

The negotiation portal runs nginx, while the data leak site and all three mirrors run Apache 2.4.63 on Windows 64-bit with PHP 8.4.5 . Running a Tor hidden service on Windows is an unusual OPSEC choice -- Windows has a larger attack surface, generates more telemetry, and is more susceptible to deanonymization techniques than a hardened Linux host. This is a potential vector for law enforcement takedown efforts.

The separation of negotiation (nginx) from data leak (Apache/Windows) infrastructure suggests two different systems or operators handling victim communication vs. public shaming.

Gunra makes several operational security mistakes that reduce their effectiveness and increase their exposure:

Weak PRNG in the Linux variant -- The most damaging mistake. Using rand() seeded by time() instead of /dev/urandom or getrandom() renders the entire Linux encryption scheme breakable. This is likely a porting oversight where a developer replaced Windows-specific CryptGenRandom() calls with the first libc random function they found, without understanding the cryptographic implications.

Windows-based Tor hidden service -- The Apache/Win64 server header reveals the operating system of their data leak infrastructure. This provides law enforcement with a narrower target for deanonymization.

Same-day multi-architecture upload -- All four ELF variants hit MalwareBazaar on March 4, suggesting either automated submission (unlikely for an operator) or a testing/development workflow that leaked samples.

Consistent build naming convention -- The build_ .bin pattern is a huntable fingerprint across malware repositories and network traffic.

Filesystem -- hunt for encryption artifacts:

Persistence -- hunt for unauthorized system modifications:

Network -- Suricata rules for Tor detection:

If you discover .GNRA files on your Linux infrastructure:

Published by Breakglass Intelligence. Investigation conducted 2026-03-09. 5 samples analyzed across 4 architectures. 5 Tor hidden services mapped. Weak PRNG confirmed exploitable for file recovery. Classification: TLP:CLEAR