gunra
ransomware group · aka Gunra · unknown · active since 2025-04
Victims · 7d
0flat
Victims · 30d
1active targets
Victims · 90d
10
All-time (tracked)
53since 2025-04-23
Last post
08-19 16:24UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Gunra is a double-extortion ransomware group first documented in April 2025, notable for posting large batches of new victims on its leak site in rapid succession. Vendor research in 2025 linked the group to breaches of exposed Fortinet FortiOS and FortiProxy edge devices via the actively exploited authentication-bypass flaws CVE-2024-55591 and CVE-2025-24472, with targets including critical-infrastructure and manufacturing organizations. Subsequent vendor reporting in 2025 described a Linux/ESXi encryptor variant in addition to its Windows tooling. The group maintains a global victim base, with recent leak-site listings on this dashboard spanning Latin America, Europe, and Asia (e.g., Mexico, Spain, Brazil, Thailand, Indonesia). It remained active through at least August 2026, though the 13 leak-site victims in the past 90 days on this dashboard suggest a slower cadence than the mass-posting observed at emergence.
Tactics & tooling
- Initial access via exploitation of exposed Fortinet FortiOS/FortiProxy devices using authentication-bypass flaws CVE-2024-55591 and CVE-2025-24472 (vendor research, 2025)
- Double extortion: file encryption combined with data exfiltration, with stolen-data samples posted to the leak site
- High-volume leak-site posting, listing multiple new victims in single batches
- Targeting of exposed network edge infrastructure at critical-infrastructure and manufacturing organizations (vendor research, 2025)
- Reported Linux/ESXi encryptor variant expanding beyond Windows (vendor research, 2025)
- Global targeting across Latin America, Europe, and Asia per leak-site listings
Targeted sectors
manufacturingcritical infrastructurelegal/professional servicesinsurancelogisticsfinancial services/fintechIT serviceshospitality
Notable public victims
Piramide Seguros, on-us, PT All Cosmos Biotek, Siam Stabilizers and Chemicals Co., Ltd. (SSC), MHE9 Logistica Ltda, Dissinger and Dissinger Law Firm, New Tiles S.L.
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims53 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| BOMOHSA | · 27d ago | — |
| PT All Cosmos Biotek | · Aug 6, 2026 | — |
| worldtube | · Aug 5, 2026 | — |
| Weilhotel | · Aug 2, 2026 | — |
| Siam Stabilizers and Chemicals Co., Ltd. / SSC | · Aug 2, 2026 | — |
| Dissinger and Dissinger Law Firm | · Jul 18, 2026 | — |
| New Tiles S.L. | · Jul 13, 2026 | — |
| Pirámide Seguros | · Jul 10, 2026 | — |
| on-us | · Jul 10, 2026 | — |
| Yuditec S.A. | · Jul 10, 2026 | — |
| MHE9 Logística Ltda | · Jun 17, 2026 | — |
| Suárez&Clavera | · Jun 17, 2026 | — |
| Cambridge Law Chambers | · Jun 12, 2026 | — |
| Cablematic Dos Mil SLU | · Jun 1, 2026 | — |
| SOMAFIX | · Jun 1, 2026 | — |
| STAREMPIRE | · May 31, 2026 | — |
| KUKJE PHARM CO.,LTD | · Apr 7, 2026 | — |
| Frontier Financial Group | · Mar 20, 2026 | — |
| El Ezh Building Contracting LLC | · Mar 20, 2026 | — |
| Thai Petroleum & Trading Co., Ltd. | · Mar 20, 2026 | — |
| Grupo PyD | · Mar 20, 2026 | — |
| Ipiranga Contábil | · Mar 20, 2026 | — |
| NeoDerm | · Mar 20, 2026 | — |
| INCARFE S.L. | · Mar 20, 2026 | — |
| Eric Davis Dental | · Mar 20, 2026 | — |
| Ventilaciones Nerual, S.L. | · Mar 20, 2026 | — |
| Envy Recycling | · Mar 20, 2026 | — |
| VINTAGE HOMESTEAD GmbHy | · Mar 20, 2026 | — |
| Diamond | · Mar 20, 2026 | — |
| ASPShips | · Mar 20, 2026 | — |
| triotech.com.sg | · Mar 20, 2026 | — |
| bkksky.com | · Mar 20, 2026 | — |
| INHA University | 650GB internal main database | · Dec 29, 2025 | INHA University | 650GB internal main database |
| miraense.com | 8TB internal documents, 2TB billing database | · Oct 1, 2025 | miraense.com | 8TB internal documents, 2TB billing database |
| hwacheon | 265GB Financial Documents (will add more|not fully published yet) | · Sep 10, 2025 | hwacheon | 265GB Financial Documents (will add more|not fully published yet) |
| Samwha Capacitor Group | 114GB Financial Documents | · Sep 3, 2025 | Samwha Capacitor Group | 114GB Financial Documents |
| SEGUROS AMÉRICA | · Aug 18, 2025 | SEGUROS AMÉRICA |
| Seoul Guarantee Insurance | 13.2T pure compressed oracle database | · Aug 4, 2025 | Seoul Guarantee Insurance | 13.2T pure compressed oracle database |
| SEGUROS AMÉRICA | 1 Million customer data | · Aug 4, 2025 | SEGUROS AMÉRICA | 1 Million customer data |
| American Hospital Dubai | 40TB | · Jul 14, 2025 | Industry: Health Care | Location: Dubai, UAE | https://www.ahdubai.com |
| Justicia Penal Militar | 45TB | · Jul 14, 2025 | Industry: Gobierno | Location: Colombia | http://www.justiciamilitar.gov.co/home |
| ACCS Le Groupe | · Jun 6, 2025 | Industry: Building automation, systems integration, and energy optimization for smart buildings |
| American Hospital Dubai | · Jun 5, 2025 | Industry: Healthcare Service |
| Olho D'Água Distribuidora | · Jun 5, 2025 | Industry: Water distribution and tanker truck services |
| Anjos Ramos | · Jun 5, 2025 | Industry: Advocacy / Law Firm |
| Adria Grupa | · Jun 5, 2025 | Industry: Facilities Management & Commercial Cleaning, Business Services |
| Grupo Jorge Batista | · May 12, 2025 | Industry: E-Commerce |
| TOMOKU CO., LTD. | · May 4, 2025 | Industry: Paper/Soft Products |
| Bioprofarma Bagó S.A | · Apr 28, 2025 | Industry: Pharmaceuticals |
| KLINGER Italy | · Apr 27, 2025 | Industry: Level Gauges, valves and industrial gaskets |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .