The Reveal Platform
Intel Name: Gunra ransomware group unveils efficient linux variant
Date of Scan: July 30, 2025
Impact: High
Summary: Gunra ransomware’s Linux variant significantly expands the group’s attack surface, reflecting its intention to move beyond its initial targets. This variant includes key features such as the ability to execute up to 100 encryption threads simultaneously and perform partial encryption. Attackers can customize the extent of file encryption and store RSA-encrypted keys in separate keystore files. Since first being observed in April 2025, Gunra has impacted organizations across Brazil, Japan, Canada, Türkiye, South Korea, Taiwan, and the United States. Its victims span various sectors, including manufacturing, healthcare, IT, agriculture, legal, and consulting services.
