Breakglass Intelligence analyzed Gunra ransomware's Linux variant, an 84KB Conti-derived ELF expanded into x86-64, i386, ARM, and Windows builds for enterprise and multi-architecture targeting. The Linux build encrypts files with ChaCha20 and RSA-4096, but derives ChaCha20 key material from musl-libc rand() seeded with time(), allowing responders to brute force likely encryption timestamps for .GNRA files. The malware creates .GNRA files, .keystore key storage, and R3ADM3.txt ransom notes while modifying logs, PAM, Polkit, sudoers policy, cron jobs, init scripts, and Bash startup scripts. Breakglass also maps Tor infrastructure, notes Windows-based Apache/PHP leak-site hosting as an OPSEC weakness, and provides hashes, hidden services, behavioral indicators, YARA/Sigma detections, and recovery guidance.