SK Shieldus reports that Gunra ransomware, first seen in April 2025, attacked a South Korean financial institution in July 2025, causing roughly four days of service disruption and alleged theft of 13.2 TB of database material. The group operates a Tor leak site that lists victims, stolen-data types, posting dates, and negotiation deadlines, then escalates pressure by publishing previews or threatening full disclosure when negotiations fail. Gunra’s Linux variant accepts parameters for threads, target path, extensions, encryption ratio, RSA public key file, key storage, and encryption limits, using ChaCha20 with partial 1 MB encryption intervals and separate or appended key storage. The Windows variant runs without command-line parameters, creates a mutex, drops R3ADM3.txt ransom notes, excludes selected system paths and file types, and applies different encryption strategies to database and virtual-machine files.