The Gunra ransomware gang employs a methodical strategy that aims to thwart all potential recovery routes before implementing the malware. In one documented incident, they obliterated backup and archived data from both their primary data center and disaster-recovery site prior to and after deploying the ransomware. This approach significantly increases pressure on victims, even for organizations with standard backup procedures.
It later evolved into a ransomware-as-a-service operation, offering affiliates a management panel, customizable ransomware builders, cross-platform payloads, and operational documentation. Prior to encrypting systems, affiliates steal sensitive data such as business documents, databases, personally identifiable information, and internal email. Gunra has targeted organizations across various sectors globally, including government, healthcare, financial services, manufacturing, transportation, utilities, nonprofit services, and more.
They employed Impacket utilities such as psexec.py, smbclient.py, and secretsdump.py for SMB-based lateral movement and credential theft in several instances. One incident involved attackers obtaining NTDS password hashes from domain controllers, allowing them to perform pass-the-hash and pass-the-ticket activities against privileged systems. Such activity indicates that ransomware incidents are not merely malware events; they represent comprehensive network compromises that can persist until every unauthorized account, session, and access path is eradicated.
Before deploying ransomware, Gunra gathers high-value data. Gunra uses Windows Management Instrumentation to delete Volume Shadow Copies, cutting off many local restoration options.
