AhnLab Uncovers Gunra Ransomware: Dual-Platform Threat with Weak Linux Encryption

According to ASEC, the AhnLab Security Intelligence Center, Gunra ransomware began operations in April 2025 and has conducted attacks across industries worldwide, including South Korea. The threat targets both Windows and Linux environments, delivering a Windows EXE and a Linux ELF variant that encrypt data and exfiltrate files before demanding a ransom.

The Linux variant uses ChaCha20 but relies on an insecure random-number generator based on time() and rand(), which can lead to identical key and nonce sequences and enables potential recovery by brute force. In contrast, the Windows EXE version uses ChaCha8 and the CryptGenRandom() API, described as cryptographically secure, making decryption effectively irreversible on that platform.

The Linux incarnation can encrypt files progressively with options such as –threads, –path, and –exts, and supports both file-level and disk encryption depending on the chosen arguments, with certain files excluded to keep ransom notes readable. If the –store argument is enabled, Gunra saves the ChaCha20 key in a .keystore file; otherwise the key is appended to the encrypted file, and disk encryption applies across partitions when the disk value is used.