A Linux variant of Gunra ransomware derived from Conti reduces its effective ChaCha20 key space to only 256 possibilities by repeatedly reseeding C's `rand()` with the same second-resolution timestamp. This fills the 32-byte key and 12-byte nonce with one repeated byte, allowing a known-plaintext attack against predictable file headers such as `%PDF`. 78ResearchLab developed a proof-of-concept decryptor and reported recovering all encrypted test files without corruption.