New Gunra Ransomware Linux Variant Launches 100 Encryption Threads with Partial Encryption Feature

The new Gunra group has expanded its attack surface beyond Windows PCs by releasing a Linux version of their virus, which was initially discovered in April 2025. This is a major uptick in the ransomware ecosystem.

This development underscores the group’s strategic pivot toward cross-platform targeting, inspired by predecessors like Conti ransomware.

Trend Micro’s threat intelligence has tracked Gunra’s activities across enterprises in Brazil, Japan, Canada, Turkiye, South Korea, Taiwan, and the United States, impacting sectors including manufacturing, healthcare, IT, agriculture, law, and consulting.

Notable incidents include the alleged exfiltration and leakage of 40 terabytes of data from a Dubai hospital in May 2025, alongside attempts against government entities and industries such as transportation.

With 14 victims claimed on its leak site since inception, Gunra demonstrates rapid proliferation.

The Linux variant, analyzed via Trend Vision One, incorporates advanced indicators of compromise (IOCs) detection, enabling proactive blocking and ...