Gunra Ransomware Targets Windows and Linux with Dual Encryption

The cybersecurity landscape continues to face persistent threats from emerging ransomware groups, with Gunra representing a significant concern since its emergence in April 2025.

This threat actor has launched systematic attacks across multiple industries and geographic regions, including documented incidents in Korea.

What makes Gunra particularly noteworthy is its dual-platform capability—the group distributes separate malware variants targeting both Windows and Linux systems, each employing distinct encryption methodologies.

Understanding these technical differences is critical for organizations developing effective incident response and threat mitigation strategies.

Gunra’s operational approach reflects a sophisticated understanding of enterprise infrastructure.

The ransomware exists in two distinct formats: an executable (EXE) file for Windows environments and an ELF (Executable and Linkable Format) binary for Linux systems.

This dual-variant strategy enables the threat group to maximize damage across heterogeneous computing environments—a common pattern among advanced ransomware operations targeting enterprises with mixed infrastructure.

The deployment of separate binaries is not merely cosmetic; each variant incorporates fundamentally different cryptographic implementations tailored to the specific operating system’s capabilities.

This distinction has profound implications for both attackers and defenders, creating dramatically different threat profiles depending on the targeted platform.

Technical Infrastructure and Configuration

Both Gunra variants operate through a command-line interface requiring specific arguments to function.

The malware demands five mandatory parameters: thread count for parallelized encryption, target path, file extensions to encrypt, encryption ratio, and the RSA public key file path.

The vulnerability stems from the random number generation mechanism used to create encryption keys and nonce values for the ChaCha20 algorithm.

This modular design suggests deliberate engineering for operational flexibility, allowing operators to customize attacks based on target environment characteristics and objectives.

The encryption preparation phase demonstrates methodical file system traversal capabilities. The malware can target individual files, entire directories with subdirectory recursion, or full disk encryption when configured appropriately.

File selection logic incorporates extension filtering with support for up to 32 custom extensions, though certain system files like README files and those with .encrt extensions are excluded from encryption to maintain system functionality.

Analysis of the ELF format reveals a catastrophic cryptographic flaw that fundamentally undermines the security of encrypted files.

The Gunra developers implemented a seeding mechanism relying on the time() function without accounting for execution speed—the process completes so rapidly that multiple iterations receive identical seed values.

This implementation failure causes the rand() function to generate repeated byte sequences, resulting in 32-byte keys and 12-byte nonce arrays containing patterns of identical bytes.

The consequence is devastating: encrypted files can be recovered through brute-force attacks testing the 256 possible byte values from 0x00 to 0xFF.

Security researchers have successfully demonstrated decryption of Gunra-encrypted files using this technique, with the attack proving viable against the weak cryptographic material.

Windows Variant: Stronger Security Posture

The Windows EXE variant presents a markedly different threat profile. Rather than relying on the time() function, the Windows implementation leverages the CryptGenRandom() API through the Windows Cryptographic Service Provider (CSP).

This enterprise-grade random number generation produces cryptographically secure values, rendering brute-force decryption attacks impractical.

The Windows version also employs ChaCha8 instead of ChaCha20, further distinguishing its implementation from the Linux counterpart. This divergence likely reflects the developers’ access to superior cryptographic libraries and security practices on the Windows platform.

The disparate security implementations between Gunra’s two variants create an asymmetric threat landscape. Organizations running primarily Linux infrastructure face significantly elevated decryption risks compared to Windows-dominant environments.

This vulnerability gap underscores the importance of platform-specific threat intelligence and incident response planning.

Defenders should prioritize immediate isolation of systems showing Gunra indicators and consider decryption recovery operations feasible for Linux-compromised systems using identified brute-force methodologies.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.