Gunra Ransomware-as-a-Service and Double-Extortion Activity

Gunra ransomware, first observed in early 2025 and expanded to a Ransomware-as-a-service (RaaS) model in 2026, is a sophisticated threat derived from leaked Conti source code. Operating under the name 'Golden Community,' the group utilizes a double-extortion strategy, exfiltrating sensitive data to dedicated leak sites before deploying a multi-threaded ChaCha20 + RSA-4096 encryptor. The actors have demonstrated broad geographic impact across the Americas, Europe, and Asia-Pacific, actively recruiting initial access brokers to compromise enterprise networks.

Technical analysis reveals a heavy reliance on exploiting known vulnerabilities in internet-facing devices (specifically CVE-2024-55591 and CVE-2025-24472) and abusing administrative tools like Impacket, OpenSSH, and RClone. Notably, the group targets both Windows and Linux environments and employs advanced persistence techniques, including the modification of multi-factor authentication (MFA) processes to maintain access. The threat is characterized by its high speed of encryption and strategic deletion of backups to prevent recovery without ransom payment.