Gunra ransomware operators are taking a destructive approach designed to remove every easy recovery path before locking victim files.
In a documented incident, the group deleted backup and archived data stored at both the primary data center and the disaster-recovery site before and after deploying ransomware.
The tactic greatly increases pressure on victims because even organizations with standard backup plans may find their recovery infrastructure unavailable.
Gunra emerged in April 2025 as a ransomware family linked to the leaked Conti source code.
It later expanded into a ransomware-as-a-service operation, allowing affiliates to use a management panel, configurable ransomware builder, cross-platform payloads, and operational documentation.
U.S. and South Korean agencies have also observed the group using the Golden Community name.
The threat uses a double-extortion model. Before encrypting systems, affiliates steal sensitive data such as business documents, databases, personally identifiable information, and internal email.
They then threaten to publish or sell the stolen information through a Tor-based leak site if the victim does not pay.
Gunra has targeted organizations in government, healthcare, financial services, manufacturing, transportation, utilities, nonprofit services, and other sectors across several global regions.
Gunra Cripples Backup Recovery
Gunra affiliates commonly gain initial access by exploiting vulnerable internet-facing firewalls, VPN gateways, and remote services.
Investigators identified exploitation of CVE-2024-55591 and CVE-2025-24472, FortiOS and FortiProxy authentication-bypass flaws. The bugs can be abused to create a persistent FortiOS superuser account named forticloud-sync.
Once inside, the attackers rely heavily on legitimate administration tools and remote services. They have used Impacket utilities, including psexec.py, smbclient.py, and secretsdump.py, for SMB-based lateral movement and credential theft.
In one case, attackers collected NTDS password hashes from domain controllers, enabling pass-the-hash and pass-the-ticket activity against privileged systems.
The group has also modified account and authentication settings to maintain access. In a documented intrusion, Gunra actors altered an unused account so it no longer required a password change.
They also changed files on a virtual desktop infrastructure portal so a chosen one-time password could bypass multi-factor authentication.
Such activity shows that ransomware incidents are not just malware events; they are full network compromises that can persist until every unauthorized account, session, and access path is removed.
Before ransomware deployment, Gunra collects high-value data. The actors have used a malicious file called main.exe to take data from Microsoft OneDrive and SharePoint.
They also archive files and exfiltrate them through services such as Mega, using tools including 7-Zip, RClone, and FileZilla. Reported data theft has reached tens of terabytes in some incidents, picussecurity said.
The backup attack is especially serious. Gunra deletes Windows Volume Shadow Copies through Windows Management Instrumentation, blocking many local restoration options.
More importantly, its operators have gone beyond endpoint backups by deleting data on backup infrastructure in both production and disaster-recovery environments.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
