Gunra Ransomware Expands RaaS After Conti Locker Shift

Gbhackers •Mayura Kathir • May 15, 2026

Gunra ransomware is rapidly evolving into a more structured and dangerous cybercrime operation after shifting from a Conti-based locker to its own Ransomware-as-a-Service (RaaS) model. First discovered in April 2025, the group initially targeted a small number of victims, but its recent operational changes have significantly increased its reach and impact across industries. Gunra first […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Groups The Gentlemen and Gunra Intensify RaaS Operations in 2026 The Gentlemen, a ransomware-as-a-service (RaaS) group, has emerged as a significant threat since its inception in mid-2025, with 332 reported victims in the first five months of 2026. They leverage Fortinet and Cisco edge devices for initial access. Similarly, Gunra ransomware, which transitioned from the Conti group, has expanded its operations, targeting numerous organizations and employing a business-like model that includes selling access and leaking stolen files. Both groups represent a growing concern in the cybersecurity landscape, with their operations indicating a shift towards more organized and sophisticated cybercrime. The current status of these threats is active, with ongoing attacks and recruitment efforts by both groups. 3 sources 67

Gunra Ransomware Expands RaaS After Conti Locker Shift

The full story

Extracted Entities

Attack Types (1)

Ransomware Groups (2)