Threat Intelligence Report May 6 - May 12 2025

Gunra Ransomware Group

Gunra is a newly emergent ransomware family identified in April 2025. Based on leaked Conti source code, it represents a new wave of double-extortion ransomware that combines encryption with sensitive data theft. Victims are pressured into negotiations through a bespoke Tor-based portal and warned that exfiltrated data will be published if no contact is made within 5 days.

Gunra has already hit organisations in Japan, Egypt, Italy, Argentina, and Panama, and early indicators show targeting across healthcare, pharmaceuticals, manufacturing, and real estate. The ransomware adds the “.ENCRT” extension to encrypted files and drops a ransom note titled “R3ADM3.txt” into each affected directory. The note provides instructions for contacting the operators- who refer to themselves as the "Manager"- via a private chat hosted on the Tor network.

Gunra uses advanced evasion techniques including process injection, sandbox detection via IsDebuggerPresent, and Windows Management Instrumentation (WMI) commands to destroy backups and limit recovery. Its binary is heavily obfuscated, minimising detection. While no worm capabilities have been confirmed, the ransomware’s precision suggests a manual affiliate model targeting high-value entities.

Detailed TTPs

Gunra operators likely initiate attacks through spear-phishing emails containing malicious attachments or links. This method allows attackers to bypass perimeter defences and gain an initial foothold without relying on exploits. Given Gunra’s Conti-based lineage, phishing is the preferred method due to its simplicity and high success rate in targeting human vulnerabilities.

Once inside the target environment, Gunra executes its payload using Windows Management Instrumentation (WMI) and native Windows API calls. This dual-layer execution helps evade detection by masquerading as legitimate system behaviour. The use of WMI for shadow copy deletion ensures critical backups are destroyed before encryption begins, while API calls like FindNextFileExW and TerminateProcess facilitate recursive file targeting and neutralisation of defensive processes.

To maintain access and potentially spread within the environment, Gunra leverages process injection- executing malicious code within legitimate processes to remain undetected. The malware’s potential bootkit-level persistence implies deep system embedding, possibly modifying system startup behaviour to reload after reboots. Although no worm behaviour has been confirmed, its structure may support manual lateral movement by operators.

To maximise impact, Gunra escalates privileges by interacting with process tokens using APIs like GetCurrentProcess and OpenProcess. These allow it to impersonate or hijack higher-privileged sessions, facilitating access to sensitive files, deletion of backups, and disabling security features- all critical for successful system-wide encryption.

Gunra employs anti-analysis strategies to avoid detection in sandbox and forensic environments. It uses functions such as IsDebuggerPresent to identify virtual or debugged execution contexts and may alter behaviour or terminate execution when analysis is detected. Furthermore, the binary is heavily packed and obfuscated, thwarting static analysis by antivirus engines and increasing time-to-detection.

In line with double-extortion practices, Gunra stages data locally and exfiltrates it via encrypted communication channels. By transferring sensitive data before encryption, the attackers gain leverage to extort victims not just through file encryption but also by threatening public exposure on their Tor-based leak site.

Gunra forgoes traditional C2 infrastructure in favour of anonymous, encrypted communication through Tor hidden services. Victims are instructed to visit .onion addresses to negotiate with the attackers, often identified as “Manager.” This decentralisation complicates attribution and takedown efforts by defenders and law enforcement.

TTP Chart

IOCs

Ransomware Victims Worldwide

The United States continues to dominate the global ransomware victim landscape, accounting for 52.38% of all reported attacks last week. Its concentration of high-value targets, digital dependency, and extensive business infrastructure make it a perennial Favorite for both targeted and opportunistic ransomware campaigns.

Australia ranks second with 9.52%, indicating that attackers are maintaining a strategic focus on the APAC region—particularly where cloud adoption and managed services are widespread.

Canada follows at 5.95%, once again underlining its vulnerability due to tightly connected supply chains and digital dependencies with US organisations.

Other impacted nations include the United Kingdom (3.57%), Spain and Japan (each at 2.38%), demonstrating continued threat activity across Europe and Asia.

A wide range of countries—including India, Portugal, Colombia, Italy, Singapore, Germany, Dominican Republic, Belgium, Croatia, Indonesia, France, Austria, Philippines, Switzerland, Brazil, UAE, Nigeria, and Thailand—each reported 1.19% of total ransomware victims, reflecting the increasingly global reach of threat actors.

This distribution reinforces the notion that no region is immune. Attackers continue to exploit weak points across borders, industries, and organisational sizes. To combat this global threat, security teams must prioritise continuous risk assessment, invest in international threat intelligence collaboration, and enforce resilient data recovery strategies across all geographic locations.