Gunra Ransomware Leveraging Attacking Windows and Linux Systems with Two Encryption Methods

[[{“value”:”

The threat landscape continues to evolve as Gunra ransomware emerged in April 2025, establishing itself as a significant threat to organizations worldwide.

This dual-platform attack group has demonstrated a systematic approach to compromising both Windows and Linux environments, making their campaign one of the more noteworthy distributed ransomware operations in recent months.

Organizations across multiple industries and sectors have reported successful infection attempts, with damage cases extending into the Asia-Pacific region, including South Korea.

Gunra operates with a familiar yet effective ransomware model: encrypt critical files on infected systems, exfiltrate sensitive data from compromised organizations, and demand ransom payments with threats of public disclosure if demands are not met.

What distinguishes Gunra from other ransomware operators is its deliberate development of platform-specific variants. The group distributes their malware in two distinct formats: executable files for Windows environments and ELF binaries for Linux systems.

This strategic approach allows them to maximize their attack surface and penetrate diverse infrastructure environments that many organizations maintain.

ASEC analysts identified that the Gunra ransomware operates through a command-line interface requiring multiple parameters to execute its encryption routines.

The malware performs validity checks on provided arguments before initializing its main execution routine, ensuring all necessary parameters are present and valid.

This structured approach demonstrates the sophistication and careful engineering behind the campaign.

Cryptographic Weakness and Decryption Vulnerability

The technical analysis reveals a critical vulnerability in the ELF version of Gunra ransomware that fundamentally weakens its encryption scheme.

ASEC researchers discovered that the malware utilizes the ChaCha20 encryption algorithm with a cryptographically insecure random number generation function.

The vulnerability stems from the seed generation process, which relies on the time() function to create predictable values for the rand() function.

The flaw becomes apparent when examining how the 32-byte encryption key and 12-byte nonce values are generated. When multiple encryption iterations occur within extremely short time intervals, the seed value remains identical across different execution threads.

This causes the rand() function to produce identical byte sequences, resulting in encryption keys and nonce arrays containing repeated byte patterns.

Consequently, the ChaCha20 keys become cryptographically weak and susceptible to brute-force attacks across 256 possible byte values.

This cryptographic oversight enables file decryption with high probability using brute-force techniques based on byte values ranging from 0x00 to 0xFF.

In stark contrast, the Windows EXE version implements ChaCha8 encryption with key generation through the CryptGenRandom() API, employing cryptographically secure random number generation that makes decryption virtually impossible.

This disparity between implementations highlights the varying security postures across different platforms.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Gunra Ransomware Leveraging Attacking Windows and Linux Systems with Two Encryption Methods appeared first on Cyber Security News.

“}]] 

​Read More  Cyber Security News