New Gunra Ransomware Targets Windows Systems, Encrypts Files, and Erases Shadow Copies

AhnLab’s Threat Intelligence Platform has been effectively tracking ransomware groups and their emerging attack methods on the dark web, including the sophisticated Gunra ransomware. The analysis highlights Gunra’s tactics, encryption techniques, and measures organizations can take to defend against such threats. #Gunra #Conti #DarkWebWatch #RansomwareTA #AhnLabTIP

Keypoints

The AhnLab Threat Intelligence Platform monitors dark web forums for ransomware activities and emerging groups.
Gunra ransomware, suspected to be derived from Conti, emerged in April 2025 with advanced extortion tactics.
Gunra targets Windows systems, encrypting user files using RSA and ChaCha20 algorithms while avoiding critical system files.
The ransomware employs a five-day deadline for ransom negotiations, increasing pressure on victims.
Preventive measures include applying security patches, deploying antivirus, maintaining offline backups, and practicing vigilance against phishing.