Gunra
| Active
Gunra is a financially motivated ransomware group that emerged in April 2025, using double-extortion tactics against real estate, pharmaceuticals, and manufacturing sectors across Japan, Egypt, Panama, Italy, and Argentina, deploying separate Windows and Linux variants with a strict five-day payment deadline.
Victims
36
First Discovered
2025-04-23
victim
Last Discovered
2026-04-08
victim
Inactive Since
35
days
Avg Delay
9.2
days
Infostealer
16.7%
victims with domain
Countries
20
hit
Attack Velocity — Last 12 months
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Public Data Share | No | 2026-04-28T07:24:00 |
gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onion
|
|||
|
G*NRA | Yes | 2026-05-13T20:08:14 | nginx |
lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 9
- Healthcare 6
- Business Services 4
- Financial Services 3
- Technology 3
Top 5 Countries
-
Brazil
5
-
Korea, Republic of
5
-
Hong Kong
2
-
United Arab Emirates
2
-
Thailand
2
Heatmap
Ransom Notes (2)
YARA Rules (1)
Indicators of Compromise (IoCs) (5)
Hash MD5
4
IP Address
1
Victims (36)
[AI generated] Thai Petroleum & Trading Co., Ltd. is a company based in Thailand operating in the pe…
[AI generated] Eric Davis Dental is a dental practice based in the United States. The company operat…
[AI generated] Triotech is a Singapore-based technology company operating in the IT solutions and se…
[AI generated] KUKJE PHARM CO., LTD is a South Korean pharmaceutical company engaged in the manufact…
[AI generated] INHA University is a private research university located in Incheon, South Korea. It …
[AI generated] Samwha Capacitor Group, founded in 1973 in South Korea, is a global company manufactu…
[AI generated] Seoul Guarantee Insurance (SGI) is a South Korean company specializing in credit and …
[AI generated] ACCS Le Groupe is a French-based company specializing in the delivery of IT solutions…
