Gunra Ransomware Uses Up to 100 ChaCha20 Threads to Rapidly Encrypt Linux Systems

Gunra ransomware has added a Linux encryptor to its arsenal, giving affiliates control over how they lock enterprise data.

The command-line payload can launch up to 100 encryption threads, a design that compresses the time defenders have to detect and interrupt an attack on Linux servers, virtual machines, NAS appliances, and storage.

Its operators later introduced a Linux variant and, by January 2026, formalized an affiliate program marketed alongside management tooling, a configurable builder, locker payloads, and documentation.

The Linux binary is not a one-size-fits-all encryptor. Operators provide runtime arguments to set thread count, choose extensions, select all discovered files, set a per-file encryption limit, and define a partial-encryption ratio.

This allows an affiliate to tune the payload for speed, impact, and storage profile. Rather than encrypting every byte of a large database or virtual-disk image, partial encryption can corrupt critical content quickly while reducing execution time.

Gunra uses a hybrid cryptographic design: a 32-byte ChaCha20 key and 12-byte nonce encrypt file content in 1 MB chunks, while RSA-4096 protects the per-file cryptographic material.

The Linux implementation can store the RSA-encrypted material in separate keystore files instead of attaching it to the encrypted object.

Picus security Researchers said that, Gunra is a ransomware-as-a-service operation derived from Conti source code leaked in 2022.

Attribute	Detail
Aliases	Gunra, Golden Community
Malware type	Ransomware-as-a-service (RaaS), double extortion
First seen	April 2025 on Windows. Linux variant reported July 2025. RaaS program launched January 2026
Lineage	Built on the Conti source code leaked in 2022
Target platform	Windows and Linux
Encryption scheme	ChaCha20 with RSA-4096
Initial access CVEs	CVE-2024-55591 and CVE-2025-24472
Regions affected	Americas, Europe, Middle East, Africa, and Asia-Pacific

Files in the Linux campaign were renamed with the .ENCRT suffix; the Windows payload writes R3ADM3.txt ransom notes after processing directories.

Gunra Ransomware Attack

The operational significance is the parallelism. Gunra’s thread cap is operator-controlled rather than tied to host processor count. The payload waits for workers to complete, polling its shared thread counter every 10 milliseconds.

That behavior supports a fast, sustained encryption phase while allowing an affiliate to avoid overwhelming a host so severely that it becomes unusable before the locker finishes.

Encryption is only the final pressure point. Gunra follows a double-extortion model in which affiliates steal documents, databases, personally identifiable information, and internal email before demanding payment through a Tor-based negotiation portal.

Investigators observed main.exe targeting OneDrive and SharePoint, while compressed archives were exfiltrated to Mega. Reported theft has reached tens of terabytes, making restoration of encrypted systems insufficient if stolen data is exposed.

Initial access has repeatedly involved internet-facing FortiOS and FortiProxy devices. The actors exploited CVE-2024-55591 and CVE-2025-24472, authentication-bypass flaws that can be abused through scheduled tasks to establish the forticloud-sync superuser account with a hard-coded password.

Inside victim environments, the group has used Impacket utilities for SMB movement and NTDS credential dumping, OpenSSH for tunneling, stolen VDI session data for RDP pivots, and modified VDI authentication processing to make an attacker-selected OTP bypass MFA.

Recovery is deliberately degraded before deployment. Gunra has invoked WMI through cmd.exe to remove volume shadow copies and, in one incident, deleted backup and archived data in both primary and disaster-recovery infrastructure.

Defenders should immediately patch exposed Fortinet devices, audit for forticloud-sync and unexpected privileged accounts, inspect VDI authentication files, and isolate systems showing anomalous archive creation, cloud-transfer activity, Impacket execution, or rapid renames.

The Picus Platform provides Gunra-focused attack simulations and maps prevention signatures across deployed controls, giving defenders a way to test whether their stack blocks the intrusion and encryption chain before affiliates do today.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now