Gunra-Ransomware-IoCs9yssWBR.txt (834 B)

Gunra expanded its ransomware operations with a configurable Linux variant capable of running up to 100 encryption threads. The malware uses ChaCha20 for file data and RSA to protect generated key material, supports partial encryption, and can target selected extensions, directories, individual files, or explicitly specified block devices. Encrypted files receive the `.ENCRT` extension, while the Linux build omits a ransom note and can store RSA-encrypted blobs in separate keystore files.