AhnLab analyzed a Linux ELF variant of Gunra ransomware, a group active since April 2025 that targets organizations across multiple countries and industries and has caused confirmed domestic cases. The ELF variant accepts arguments for target path, extensions, thread count, encryption ratio, key storage, and encryption limits, then encrypts files or disks with ChaCha20. Its key and nonce generation uses time-based rand() calls that can produce repeated-byte values, making many encrypted files recoverable by brute forcing 256 possible byte values. AhnLab contrasts this with the Windows EXE variant, which uses ChaCha8 and CryptGenRandom(), making decryption far less practical, and lists MD5 94b68826818ffe8ceb88884d644ad4fc with product detection names.