Gunra Ransomware Expands RaaS Operations After Shifting From Conti

Cybersecuritynews •Tushar Subhra Dutta • May 15, 2026

Gunra ransomware has quickly grown from a new threat into a serious global problem, hitting dozens of organizations in less than a year. The group behind it is not just encrypting data, but also running a business-like operation that sells access, leaks stolen files, and recruits partners to spread its malware. For defenders, this is […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Groups The Gentlemen and Gunra Intensify RaaS Operations in 2026 The Gentlemen, a ransomware-as-a-service (RaaS) group, has emerged as a significant threat since its inception in mid-2025, with 332 reported victims in the first five months of 2026. They leverage Fortinet and Cisco edge devices for initial access. Similarly, Gunra ransomware, which transitioned from the Conti group, has expanded its operations, targeting numerous organizations and employing a business-like model that includes selling access and leaking stolen files. Both groups represent a growing concern in the cybersecurity landscape, with their operations indicating a shift towards more organized and sophisticated cybercrime. The current status of these threats is active, with ongoing attacks and recruitment efforts by both groups. 3 sources 67

Extracted Entities

Gunra Ransomware Expands RaaS Operations After Shifting From Conti

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Ransomware Groups (2)