Skip to main content
Darkfield

Operator dossier

gunra is a ransomware operator currently active on public leak sites. Darkfield has indexed 46 public victims claimed by this operator between April 23, 2025 and July 10, 2026. Gunra is an emerging ransomware group that was first observed in April 2025, operating with primarily financial motivations based on their targeting patterns across multiple high-value sectors. The group's origin and affiliations remain unclear due to limited public documentation from major security vendors, though their geographic targeting suggests possible international operations given their focus on victims across Brazil, South Korea, Japan, Canada, and Egypt. With approximately 20 known victims to date, Gunra appears to follow conventional ransomware attack methodologies typical of financially-motivated cybercriminal groups, though specific technical details regarding their initial access vectors, encryption methods, or use of double extortion tactics have not been publicly documented by major threat intelligence sources. The group demonstrates opportunistic targeting behavior, focusing primarily on manufacturing organizations while also compromising entities in healthcare, technology, and financial services sectors, suggesting they may operate opportunistically rather than with highly specialized sector expertise. Given the recent emergence of this group in April 2025 and limited public reporting from established threat intelligence organizations such as CISA, FBI, or major security vendors, Gunra's current operational status, technical capabilities, and long-term threat trajectory require continued monitoring as more intelligence becomes available.

Most-targeted sectors

Most-affected countries

Recent disclosures by gunra

All 46 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for gunra →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

gunra

46 victims indexed · first seen 1 year ago · last activity 5 days ago

46
Victims indexed
#113 of 364 tracked operators
1y 3m
Active period
Apr 2025 → Jul 2026
10
Countries hit
top BR · 4

At a glance

Status
active
First seen
1 year ago
Last activity
5 days ago
Onion sites
6 known endpoints
Primary sector
Manufacturing · 6 hits

About

Gunra is an emerging ransomware group that was first observed in April 2025, operating with primarily financial motivations based on their targeting patterns across multiple high-value sectors. The group's origin and affiliations remain unclear due to limited public documentation from major security vendors, though their geographic targeting suggests possible international operations given their focus on victims across Brazil, South Korea, Japan, Canada, and Egypt. With approximately 20 known victims to date, Gunra appears to follow conventional ransomware attack methodologies typical of financially-motivated cybercriminal groups, though specific technical details regarding their initial access vectors, encryption methods, or use of double extortion tactics have not been publicly documented by major threat intelligence sources. The group demonstrates opportunistic targeting behavior, focusing primarily on manufacturing organizations while also compromising entities in healthcare, technology, and financial services sectors, suggesting they may operate opportunistically rather than with highly specialized sector expertise. Given the recent emergence of this group in April 2025 and limited public reporting from established threat intelligence organizations such as CISA, FBI, or major security vendors, Gunra's current operational status, technical capabilities, and long-term threat trajectory require continued monitoring as more intelligence becomes available.

References

6 links

External sources curated by the MISP threat-intel community.

Timeline

7 months
2025-04-01T00:00:00+00:00 · 52025-05-01T00:00:00+00:00 · 62025-06-01T00:00:00+00:00 · 22025-08-01T00:00:00+00:00 · 32025-09-01T00:00:00+00:00 · 22025-10-01T00:00:00+00:00 · 12025-12-01T00:00:00+00:00 · 1
2025-04-01T00:00:00+00:002025-12-01T00:00:00+00:00

Top countries

🇧🇷 Brazil
4
🇰🇷 South Korea
4
🇯🇵 Japan
2
🇨🇦 Canada
2
🇪🇬 Egypt
1
🇵🇦 Panama
1
🇮🇹 Italy
1
🇭🇷 Croatia
1
Brazil dossier →South Korea dossier →Japan dossier →Canada dossier →

Top sectors

Manufacturing
6
Healthcare
3
Technology
2
Financial Services
2
Public Sector
1
Consumer Services
1
Education
1
Manufacturing dossier →Healthcare dossier →Technology dossier →Financial Services dossier →

MITRE ATT&CK

5 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

6 known
  • http://6oeuvb4fq65xlrft2ezxjmkeqnu7oafbsevrr3ocer27wft6ivvhstqd.onion
  • http://gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onion
  • http://myeli53ogsryjg2kob4xqxtwkr5oc5zj7jr5fcfizpytwe566k5thxyd.onion
  • http://raas.lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion
  • http://ryrw2ojab62yij4y33ssfgvm2d2vwt3tcqetu6qmpwznqhooqxz3wpqd.onion
  • http://tgsst34i6z4mwdj2kpigixxb3k3xfz7xhuqnsowvfvyu3snm6nv4s5ad.onion

Source

Updated 5 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time gunra posts a victim.

Add gunra to your watchlist — Pro pings you within 5 minutes of any new gunra leak-site post, Telegram callout, or affiliate-rebrand inference.