Gunra Ransomware Expands RaaS Operations After Shifting From Conti-Based Locker

HomeCyber Security News Gunra Ransomware Expands RaaS Operations After Shifting From Conti-Based Locker By Tushar Subhra Dutta May 15, 2026 Gunra ransomware has quickly grown from a new threat into a serious global problem, hitting dozens of organizations in less than a year. The group behind it is not just encrypting data, but also running a business-like operation that sells access, leaks stolen files, and recruits partners to spread its malware. For defenders, this is not a one-off campaign but a maturing ecosystem that keeps evolving. First observed in April 2025, Gunra initially targeted five companies in South Korea, drawing attention for the speed and focus of its early attacks. At that stage, the group relied on a Conti-based ransomware locker, reusing code and techniques from an older, notorious family. Even then, the attacks showed careful planning, with activity largely aligned to business hours in Asia and concentrated bursts of operator activity in the morning. This open targeting posture means the potential damage can spread across many sectors, and new brands may emerge that are technically Gunra under a different name, as S2W said in a report shared with Cyber Security News (CSN). Over time, Gunra pivoted away from using a Conti-based locker and moved fully into a Ransomware as a Service model, where affiliates rent the tools and share profits from each attack. As the group expanded into this RaaS ecosystem, analysts from S2W documented how activity, which had slowed in late 2025, surged again once new affiliates joined and began running their own campaigns. Gunra Ransomware Expands RaaS Operations As of March 9, 2026, a total of 32 victim organizations had been confirmed, showing how quickly the threat scaled once the service model took hold. S2W’s research notes that Gunra operators run almost all of their activity through dark web forums that allow ransomware-related content. The group keeps public promotion to a minimum, preferring to post in controlled spaces such as RAMP, Rehub, Tierone, and Darkforums where they recruit affiliates, hire penetration testers, and sell compromised data. Gunra’s DLS (Source – S2W) This low profile makes Gunra harder to track, but it also signals a deliberate, long-term strategy instead of quick smash-and-grab attacks. The wider impact is not limited to a single sector or geography, because Gunra does not enforce strict limits on who its partners can target. Unlike some RaaS programs that avoid hospitals or critical infrastructure, Gunra’s internal rules do not set separate prohibited industries, and any restrictions on target countries appear to be flexible and tied to the affiliate’s home region. The move from a Conti-based locker to Gunra’s own ransomware is central to how the group expanded its RaaS operations. Initially, relying on established Conti code gave the operators a fast way to launch attacks, but it also placed limits on how much they could customize their tools and panel features. Once they developed their own ransomware and integrated it into a hosted panel, Gunra could control everything from build options to negotiation workflows. In the RaaS model described by S2W, Gunra provides a web-based panel that affiliates use to manage attacks, track victims, and handle payments. This panel exposes features such as Negotiation, Files, Lock Tool, Handler, and Brand Setting, giving affiliates a simple dashboard for running their operations. The operator does not just hand over the tools but directly participates in negotiation with victims, which suggests a central team oversees the most sensitive parts of each extortion. Gunra’s builder supports both Windows and Linux systems, allowing affiliates to generate payloads that fit their preferred targets. S2W notes that the Windows builds match earlier samples, while the Linux builds have updated execution parameters, logging, encryption logic, and even changes in parts where cryptographic weaknesses had been found. These changes show that the group is actively refining its code, closing gaps, and tuning performance based on earlier analysis. As the RaaS offering matured, Gunra’s dark web presence became more structured. The operators promote their program on forums that specialize in ransomware and data leaks, but they avoid loud marketing and rely on word-of-mouth and private contacts to onboard new partners. S2W identified at least one user believed to be a Gunra affiliate after that user posted data from the same victim as the core operator, hinting at a growing network of semi-independent actors. Expanding ecosystem and defender response Gunra’s internal rules show no strict limits on target industries, which broadens the threat surface for organizations of all sizes. Prohibited countries, if any, are applied flexibly based on where each affiliate is based, giving partners freedom to pick targets that fit their own comfort zones or regional access. On top of that, the Brand Setting feature lets affiliates launch attacks under their own ransomware brand, even though the underlying code and infrastructure belong to Gunra. This white-label model means defenders may encounter new ransomware names that are, in reality, Gunra under the hood, with shared infrastructure and overlapping techniques. As more affiliates sign up, the ecosystem can quickly spin off multiple brands, each with its own leak site, extortion style, and victim set. For security teams, this makes attribution harder and raises the risk that a “new” threat is actually an old one in disguise. S2W recommends that organizations strengthen their visibility into dark web activity, since Gunra operators and affiliates advertise, recruit, and trade stolen data primarily on these forums. Regular monitoring of ransomware-friendly communities can help detect early signs of interest in a given sector or region, and may reveal when stolen data from a specific organization is being offered for sale. The report also warns that, because Gunra does not exempt critical sectors, entities like hospitals and infrastructure providers need to maintain heightened vigilance. Another key recommendation is to track emerging ransomware brands that share technical markers with Gunra, especially when those brands appear suddenly on the dark web without a clear lineage. Since affiliates can create their own brands through the Gunra panel, defenders should treat new names with suspicion if they show similar behavior, infrastructure, or tooling. Over time, building a map of these relationships will help responders understand how attacks are linked and who might be operating behind the scenes. Finally, the S2W report highlights the importance of combining traditional security controls with threat intelligence that focuses on ransomware ecosystems like Gunra. This means not only patching systems and enforcing strong access controls, but also subscribing to intelligence feeds, engaging in information sharing, and staying current on how RaaS groups evolve their tactics. By treating Gunra as an ongoing ecosystem rather than a single malware family, organizations can better prepare for the next wave of affiliates and rebranded campaigns. Indicators of Compromise (IoCs):- Type Indicator Description URL https://s2w.inc/en/resource/detail/10571/5 S2W Gunra ransomware report resource page URL https://s2w.inc/en/resource/detail/10572/5 S2W Gunra ransomware activity and panel analysis URL https://s2w.inc/en/resource/detail/10573/5 S2W Gunra ransomware binary and mitigation section URL https://s2w.inc/en/resource/detail/10574/5 S2W resource index page related to Gunra URL https://s2w.inc/en/resource/detail/10575/5 S2W legal and footer page for Gunra report Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google. Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Tushar Subhra Dutta Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics. Trending News Microsoft Patch Tuesday May 2026 – 120 Vulnerabilities Fixed, Including 29 Critical RCE Flaws Hackers Hijack Microsoft Teams Users Account to Deliver ModeloRAT Critical 18-Year-Old NGINX Vulnerability Enables Remote Code Execution Attacks OpenAI Hit with Class-Action Privacy Lawsuit for Sharing ChatGPT Data with Google and Meta Top 10 Best Data Loss Prevention Software in 2026 Latest News Cyber Security News Shai-Hulud Worm Steals npm, GitHub, AWS, and Kubernetes Secrets From Developers Cyber Security News Hackers Abuse OAuth Device Authorization Flow to Steal Microsoft 365 Tokens Cyber Security News Microsoft Edge, Windows 11 and LiteLLM Hacked in Pwn2Own Berlin 2026 Cyber Security News Hackers Use OrBit Rootkit to Harvest SSH and Sudo Credentials From Linux Systems Cyber Security News Microsoft Warns of Attackers Using Trusted HPE Operations Agent for Malware-Free Intrusions