Ransomware group profile · #93 by claimed victims

Gunra ransomware

Gunra is a financially motivated ransomware group that emerged in April 2025, using double-extortion tactics against real estate, pharmaceuticals, and manufacturing sectors across Japan, Egypt, Panama, Italy, and Argentina, deploying separate Windows and Linux variants with a strict five-day payment deadline.

Active First seen Apr 2025

54Victims claimed on leak sites

3Victims in the last 30 days

12Victims in the last 90 days

28Countries hit

12Leak-site URLs tracked, 2 online

4 Sep 2026Latest claim recorded

Victimology

Who Gunra claims to have breached, from 54 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing13

Professional Services9

Healthcare8

Technology6

Financial Services4

Transportation3

Hospitality2

Retail & E-Commerce2

Top countries

South Korea6

Brazil6

Spain4

Hong Kong3

Thailand3

Uruguay3

Venezuela2

France2

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Blanco & Etcheverry blancoetcheverry.com	Professional Services	UY	4 Sep 2026
Occidental laoccidental.com	Energy & Utilities	VE	4 Sep 2026
BOMOHSA bomohsa.com	Not Found	HN	18 Aug 2026
PT All Cosmos Biotek allcosmos.com	Healthcare	ID	5 Aug 2026
worldtube worldtube.co.kr	Technology	KR	4 Aug 2026
Siam Stabilizers and Chemicals Co., Ltd. / SSC sakai-ssc.com	Manufacturing	TH	30 Jul 2026
Weilhotel weilhotel.com	Hospitality	MY	29 Jul 2026
Dissinger and Dissinger Law Firm dissingerlaw.com	Professional Services	US	16 Jul 2026
New Tiles S.L. new-tiles.com	Manufacturing	ES	10 Jul 2026
Pirámide Seguros segurospiramide.com	Financial Services	VE	30 Jun 2026
on-us on-us.com	Technology	HK	30 Jun 2026
Yuditec S.A. yuditec.com	Technology	UY	30 Jun 2026

All 54 Gunra victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Gunra is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Gunra ransomware still active?

Gunra is tracked as active. The most recent leak-site claim VULONE recorded is dated 4 September 2026. 3 victims were claimed in the last 30 days.

How many victims has Gunra claimed?

VULONE has recorded 54 leak-site victim claims attributed to Gunra since April 2025, across 28 countries and 12 sectors.

Which industries does Gunra target?

The sectors most often named on the Gunra leak site are Manufacturing, Professional Services, Healthcare.

Which countries are most affected by Gunra?

Most Gunra victims recorded by VULONE are located in South Korea, Brazil, Spain.

Where does VULONE get Gunra victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].