Gunra Ransomware Targets Windows and Linux with Dual Encryption

Gunra Ransomware targets Windows and Linux with dual encryption, delivering two distinct variants for each platform: an EXE file for Windows and an ELF binary for Linux. The Linux variant uses ChaCha20 for encryption, while the Windows variant employs ChaCha8 and leverages the CryptGenRandom() API, creating a noticeably stronger security posture on Windows compared with Linux.

The threat is described as having emerged in April 2025 and has conducted systematic attacks across multiple industries and geographic regions, with documented incidents in Korea. The malware’s design includes five mandatory parameters for its operation—thread count, target path, file extensions to encrypt, encryption ratio, and the RSA public key file path—and it can encrypt individual files, directories, or entire disks depending on configuration.

Security researchers have demonstrated decryption of Gunra-encrypted files using brute-force techniques against the weak cryptographic material found in the Linux variant, underscoring the divergent threat profiles between the two platforms.