Gunra is a double-extortion ransomware operation that uses phishing, data theft, Windows and Linux encryptors, Tor leak sites, and dedicated negotiation panels. The analysis identifies Conti-related code overlap in early Windows samples, reused Ngioweb and Gafgyt botnet code in Linux builds, and a cryptographic weakness that may permit recovery of files encrypted by one Linux variant. Researchers tracked repeated changes in Gunra's leak, negotiation, forum, and clear-web infrastructure, including datapub.news and several onion services.