gunra

Gunra is a ransomware operator linked to ransomware-as-a-service (RaaS) activity and state-sponsored campaigns, with attacks that used watering-hole attacks and spear phishing to deploy backdoors named Struggle and Brandoor alongside the Gunra ransomware. ThreatCluster has recorded 52 victims claimed by Gunra, with the most-targeted sectors including Manufacturing, Healthcare, Business Services, Financial Services, and Technology, and the most-affected countries including Brazil, Korea, Spain, Hong Kong, and Thailand. Recent reporting shows a pattern of Gunra being deployed in high-sophistication operations, including a state-sponsored exploitation of Korean financial software that used watering-hole and spear-phishing vectors to deliver Gunra. In addition, reporting notes that Gunra transitioned from the Conti group and has intensified RaaS operations in 2026.

Sectors: Manufacturing, Healthcare, Business Services · Countries: BR, KR, ES