Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

GUNRA · Threat actor profile

// THREAT ACTOR

GUNRA_

Active

GUNRA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of GUNRA — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

52 Victims tracked
2 / 12 Active mirrors
2025-04-23 First listing
2026-08-06 Most recent

Victims by year

  • 2026 31
  • 2025 21

Leak site mirrors

12 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onion Public Data Share snapshot · 2026-02-03 16:11
  • 2bw7r32r5eshwk2h7uekj3lwzorxds2jyhyzqyilphid3r27x5hsf4yd.onion Error snapshot · 2025-05-14 08:11
  • jzbhtsuwysslrzi2n5is3gmzsyh6ayhm7jt3xowldhk7rej4dqqubxqd.onion Private Chat with US snapshot · 2025-11-01 02:11
  • vrlgjxbl6yroq26xkcjpafgmmxrlpawvr4agppna6apfxjxav2mq66ad.onion snapshot · 2025-07-26 20:46
  • nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onion Negotiation Management System snapshot · 2026-02-03 16:21
  • tgsst34i6z4mwdj2kpigixxb3k3xfz7xhuqnsowvfvyu3snm6nv4s5ad.onion Public Data Share snapshot · 2026-02-03 16:25
  • myeli53ogsryjg2kob4xqxtwkr5oc5zj7jr5fcfizpytwe566k5thxyd.onion Public Data Share snapshot · 2026-02-03 16:15
  • 6oeuvb4fq65xlrft2ezxjmkeqnu7oafbsevrr3ocer27wft6ivvhstqd.onion snapshot · 2026-02-03 16:33
  • ryrw2ojab62yij4y33ssfgvm2d2vwt3tcqetu6qmpwznqhooqxz3wpqd.onion snapshot · 2026-02-03 16:33
  • nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onion Negotiation Management System snapshot · 2026-02-03 16:09
  • lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion G*NRA snapshot · 2026-08-06 21:03
  • raas.lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion G*NMS snapshot · 2026-08-06 21:24

Recent victims

The 50 most recent victims claimed by GUNRA. Total in the index: 52.

Date listed Victim Description
2026-08-06 PT All Cosmos Biotek
2026-08-05 worldtube
2026-08-02 Weilhotel
2026-08-02 Siam Stabilizers and Chemicals Co., Ltd. / SSC
2026-07-18 Dissinger and Dissinger Law Firm
2026-07-13 New Tiles S.L.
2026-07-10 Pirámide Seguros
2026-07-10 on-us
2026-07-10 Yuditec S.A.
2026-06-17 MHE9 Logística Ltda
2026-06-17 Suárez&Clavera
2026-06-12 Cambridge Law Chambers
2026-06-01 Cablematic Dos Mil SLU
2026-06-01 SOMAFIX
2026-05-31 STAREMPIRE
2026-04-07 KUKJE PHARM CO.,LTD
2026-03-20 Frontier Financial Group
2026-03-20 El Ezh Building Contracting LLC
2026-03-20 Thai Petroleum & Trading Co., Ltd.
2026-03-20 Grupo PyD
2026-03-20 Ipiranga Contábil
2026-03-20 NeoDerm
2026-03-20 INCARFE S.L.
2026-03-20 Eric Davis Dental
2026-03-20 Ventilaciones Nerual, S.L.
2026-03-20 Envy Recycling
2026-03-20 VINTAGE HOMESTEAD GmbHy
2026-03-20 Diamond
2026-03-20 ASPShips
2026-03-20 triotech.com.sg
2026-03-20 bkksky.com
2025-12-29 INHA University | 650GB internal main database INHA University | 650GB internal main database
2025-10-01 miraense.com | 8TB internal documents, 2TB billing database miraense.com | 8TB internal documents, 2TB billing database
2025-09-10 hwacheon | 265GB Financial Documents (will add more|not fully published yet) hwacheon | 265GB Financial Documents (will add more|not fully publishe…
2025-09-03 Samwha Capacitor Group | 114GB Financial Documents Samwha Capacitor Group | 114GB Financial Documents
2025-08-18 SEGUROS AMÉRICA SEGUROS AMÉRICA
2025-08-04 Seoul Guarantee Insurance | 13.2T pure compressed oracle database Seoul Guarantee Insurance | 13.2T pure compressed oracle database
2025-08-04 SEGUROS AMÉRICA | 1 Million customer data SEGUROS AMÉRICA | 1 Million customer data
2025-07-14 American Hospital Dubai | 40TB Industry: Health Care | Location: Dubai, UAE | https:…
2025-07-14 Justicia Penal Militar | 45TB Industry: Gobierno | Location: Colombia | http://www.…
2025-06-06 ACCS Le Groupe Industry: Building automation, systems integration, and energy optimiz…
2025-06-05 American Hospital Dubai Industry: Healthcare Service
2025-06-05 Olho D'Água Distribuidora Industry: Water distribution and tanker truck services
2025-06-05 Anjos Ramos Industry: Advocacy / Law Firm
2025-06-05 Adria Grupa Industry: Facilities Management & Commercial Cleaning, Business Servic…
2025-05-12 Grupo Jorge Batista Industry: E-Commerce
2025-05-04 TOMOKU CO., LTD. Industry: Paper/Soft Products
2025-04-28 Bioprofarma Bagó S.A Industry: Pharmaceuticals
2025-04-27 KLINGER Italy Industry: Level Gauges, valves and industrial gaskets
2025-04-23 Varela Hermanos Industry: Beverage Manufacturing Location: Panama Publish Date: Expi…

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.