CloudSEK infiltrated Gunra's newly launched ransomware affiliate program and obtained panel access, operator documentation, and a working locker sample. The analyzed Windows payload encrypts files with per-file ChaCha20 keys protected by RSA-4096, processes files in parallel, excludes system-critical paths and extensions, and operates without network connectivity. It renames encrypted files with `.ENCRT`, creates `R3ADM3.txt` ransom notes, and can store protected key material in SHA-256-named keystore files.