Gunra Ransomware

Another ransomware actor operating under the name Gunra has recently surfaced, allegedly claiming several victims in the healthcare, electronics, and beverage manufacturing sectors, as listed on their onion website. In recent activity, the ransomware they deploy appends a .encrt extension to encrypted files and drops a ransom note named r3adm3.txt in multiple directories.

The note informs victims that their data has not only been encrypted but also exfiltrated. The attackers claim to have dumped sensitive business information before locking down the system, asserting that the only way to recover the files is by contacting them to obtain a private…