THREAT ACTOR
GUNRA_
DormantGUNRA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of GUNRA, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 32
- 2025 21
Leak site mirrors
12 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onionPublic Data Share snapshot · 2026-02-03 16:11 -
2bw7r32r5eshwk2h7uekj3lwzorxds2jyhyzqyilphid3r27x5hsf4yd.onionError snapshot · 2025-05-14 08:11 -
jzbhtsuwysslrzi2n5is3gmzsyh6ayhm7jt3xowldhk7rej4dqqubxqd.onionPrivate Chat with US snapshot · 2025-11-01 02:11 -
vrlgjxbl6yroq26xkcjpafgmmxrlpawvr4agppna6apfxjxav2mq66ad.onionsnapshot · 2025-07-26 20:46 -
nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onionNegotiation Management System snapshot · 2026-02-03 16:21 -
tgsst34i6z4mwdj2kpigixxb3k3xfz7xhuqnsowvfvyu3snm6nv4s5ad.onionPublic Data Share snapshot · 2026-02-03 16:25 -
myeli53ogsryjg2kob4xqxtwkr5oc5zj7jr5fcfizpytwe566k5thxyd.onionPublic Data Share snapshot · 2026-02-03 16:15 -
6oeuvb4fq65xlrft2ezxjmkeqnu7oafbsevrr3ocer27wft6ivvhstqd.onionsnapshot · 2026-02-03 16:33 -
ryrw2ojab62yij4y33ssfgvm2d2vwt3tcqetu6qmpwznqhooqxz3wpqd.onionsnapshot · 2026-02-03 16:33 -
nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onionNegotiation Management System snapshot · 2026-02-03 16:09 -
lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onionG*NRA snapshot · 2026-09-23 00:02 -
raas.lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onionG*NMS snapshot · 2026-09-23 00:27
Recent victims
The 50 most recent victims claimed by GUNRA. Total in the index: 53.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-19 | BOMOHSA | |
| 2026-08-06 | PT All Cosmos Biotek | |
| 2026-08-05 | worldtube | |
| 2026-08-02 | Weilhotel | |
| 2026-08-02 | Siam Stabilizers and Chemicals Co., Ltd. / SSC | |
| 2026-07-18 | Dissinger and Dissinger Law Firm | |
| 2026-07-13 | New Tiles S.L. | |
| 2026-07-10 | Pirámide Seguros | |
| 2026-07-10 | on-us | |
| 2026-07-10 | Yuditec S.A. | |
| 2026-06-17 | MHE9 Logística Ltda | |
| 2026-06-17 | Suárez&Clavera | |
| 2026-06-12 | Cambridge Law Chambers | |
| 2026-06-01 | Cablematic Dos Mil SLU | |
| 2026-06-01 | SOMAFIX | |
| 2026-05-31 | STAREMPIRE | |
| 2026-04-07 | KUKJE PHARM CO.,LTD | |
| 2026-03-20 | Frontier Financial Group | |
| 2026-03-20 | El Ezh Building Contracting LLC | |
| 2026-03-20 | Thai Petroleum & Trading Co., Ltd. | |
| 2026-03-20 | Grupo PyD | |
| 2026-03-20 | Ipiranga Contábil | |
| 2026-03-20 | NeoDerm | |
| 2026-03-20 | INCARFE S.L. | |
| 2026-03-20 | Eric Davis Dental | |
| 2026-03-20 | Ventilaciones Nerual, S.L. | |
| 2026-03-20 | Envy Recycling | |
| 2026-03-20 | VINTAGE HOMESTEAD GmbHy | |
| 2026-03-20 | Diamond | |
| 2026-03-20 | ASPShips | |
| 2026-03-20 | triotech.com.sg | |
| 2026-03-20 | bkksky.com | |
| 2025-12-29 | INHA University | 650GB internal main database | INHA University | 650GB internal main database |
| 2025-10-01 | miraense.com | 8TB internal documents, 2TB billing database | miraense.com | 8TB internal documents, 2TB billing database |
| 2025-09-10 | hwacheon | 265GB Financial Documents (will add more|not fully published yet) | hwacheon | 265GB Financial Documents (will add more|not fully publishe… |
| 2025-09-03 | Samwha Capacitor Group | 114GB Financial Documents | Samwha Capacitor Group | 114GB Financial Documents |
| 2025-08-18 | SEGUROS AMÉRICA | SEGUROS AMÉRICA |
| 2025-08-04 | Seoul Guarantee Insurance | 13.2T pure compressed oracle database | Seoul Guarantee Insurance | 13.2T pure compressed oracle database |
| 2025-08-04 | SEGUROS AMÉRICA | 1 Million customer data | SEGUROS AMÉRICA | 1 Million customer data |
| 2025-07-14 | American Hospital Dubai | 40TB | Industry: Health Care | Location: Dubai, UAE | https:… |
| 2025-07-14 | Justicia Penal Militar | 45TB | Industry: Gobierno | Location: Colombia | http://www.… |
| 2025-06-06 | ACCS Le Groupe | Industry: Building automation, systems integration, and energy optimiz… |
| 2025-06-05 | American Hospital Dubai | Industry: Healthcare Service |
| 2025-06-05 | Olho D'Água Distribuidora | Industry: Water distribution and tanker truck services |
| 2025-06-05 | Anjos Ramos | Industry: Advocacy / Law Firm |
| 2025-06-05 | Adria Grupa | Industry: Facilities Management & Commercial Cleaning, Business Servic… |
| 2025-05-12 | Grupo Jorge Batista | Industry: E-Commerce |
| 2025-05-04 | TOMOKU CO., LTD. | Industry: Paper/Soft Products |
| 2025-04-28 | Bioprofarma Bagó S.A | Industry: Pharmaceuticals |
| 2025-04-27 | KLINGER Italy | Industry: Level Gauges, valves and industrial gaskets |
CONFIRMED ATTACKS
Gunra confirmed attacks: 10 verified incidents
Ransomnews has verified 10 Gunra incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from May 2025 to April 2026. South Korea accounts for 4 of them (40%), with victims recorded in 6 countries in total. The most affected sector is government, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 9.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Gunra incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| April 2026 | Kukje Pharm Co., Ltd. | Healthcare | Seongnam, South Korea | — | Unknown | Source |
| March 2026 | Trio-Tech International Pte. Ltd. | Manufacturing | Singapore, Singapore | — | Unknown | Source |
| February 2026 | Ngong Ping 360 Limited | Other | Hong Kong, Hong Kong | — | Unknown | Source |
| December 2025 | Inha University | Education | Incheon, South Korea | — | Unknown | Source |
| September 2025 | Mirae'N Seohae Energy Co., Ltd. | Utilities | Dangjin, South Korea | — | Unknown | Source |
| July 2025 | SGI (Seoul Guarantee Insurance) | Finance | Seoul, South Korea | — | Unknown | Source |
| June 2025 | Superintendencia de la Economia Solidaria (Supersolidaria) | Government | Bogotá, Colombia | — | Unknown | Source |
| June 2025 | Justicia Penal Militar y Policial | Government | Bogotá, Colombia | — | Unknown | Source |
| May 2025 | Grupo Jorge Batista (Drogarias Globo, Distribuidora Nazaria) | Healthcare | Floriano, Brazil | — | No | Source |
| May 2025 | Tomoku Co., Ltd. | Manufacturing | Tokyo, Japan | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Gunra's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.