Dark Web to Data Lockdown: Inside Gunra RaaS’s Affiliate Network and the Sophisticated Locker Powering Its Global Ransomware Surge

In the ever-evolving world of ransomware, the Gunra Ransomware-as-a-Service (RaaS) has emerged in late 2025 and surged into 2026 as one of the most technically advanced and organized criminal operations yet seen. Unlike opportunistic malware spreads of the past, Gunra combines a professionally run affiliate recruitment ecosystem on dark web forums with a highly optimized encryption “locker” — the core malware payload — designed to maximize efficiency, evade defenses, and make recovery without paying ransom nearly impossible.

Dark Web Affiliate Recruitment and the RaaS Ecosystem

Gunra’s operators recently launched a structured Affiliate Program on criminal underground forums — essentially advertising their ransomware services to other threat actors. By infiltrating these dark web recruitment posts, researchers were able to obtain authentic RaaS panel credentials and detailed documentation outlining how affiliates sign up, configure attacks, and generate custom ransomware binaries.

This model lowers the skill barrier for cybercriminals: affiliates don’t need to build ransomware themselves. Instead, they are provided with:

A ransomware management panel with attack configuration options.
Tools to generate a tailor-made ransomware “locker.”
Affiliate dashboards with victim tracking and campaign controls.

This affiliate-driven model mirrors legitimate SaaS (software-as-a-service) businesses but in a criminal context — allowing developers to focus on building the infrastructure while affiliates focus on breaching networks and deploying the malware.

Gunra’s Target Scope and Capabilities

According to intercepted recruitment data and the operational panel itself, Gunra was initially seen targeting Windows systems, but later expanded to support:

Windows
Linux
ESXi hypervisors
Network Attached Storage (NAS) systems

This cross-platform support widens the scope for potential victims and increases the operational scale of the RaaS ecosystem.

Technical Anatomy of the Gunra “Locker”

At the heart of every ransomware attack is the “locker” — the executable that encrypts files, deploys ransom instructions, and triggers extortion. Analysis of the Gunra locker reveals a highly optimized, hybrid encryption engine and intelligent file targeting logic.

1. Hybrid Encryption Scheme

Gunra combines two cryptographic algorithms to balance performance and security:

ChaCha20 Stream Cipher
- Fast, secure encryption used to scramble the contents of each victim file.
- Processes large files in efficient 1MB chunks.
- Generates a unique 32-byte ChaCha20 key and a 12-byte nonce for each file.
RSA-4096 Public-Key Encryption
- Uses a built-in 4096-bit RSA public key to encrypt the ChaCha20 key/nonce.
- Without the attacker’s private RSA key, these ChaCha20 keys cannot be decrypted, rendering file recovery infeasible.

This hybrid approach means encryption is both fast (ChaCha20) and secure (RSA-4096) — a combination increasingly favored by serious ransomware operations.

2. File System Reconnaissance and Targeting

Upon execution, the malware:

Enumerates all drive letters (A through Z).
Recursively walks directories to locate files.
Applies surgical targeting logic to skip system folders such as:
- C:\Windows
- Program Files
- Other OS-critical paths

System and executable file types (e.g., .exe, .dll, .sys) are intentionally excluded to ensure the operating system remains functional long enough for the ransom process. Instead, data files like documents, images, databases, and archives are marked for encryption.

3. Multi-Threaded Architecture

The ransomware uses a multi-threaded producer–consumer pattern:

A scanner thread enumerates directories and queues target files.
Worker threads (default 2 but configurable) encrypt files concurrently.
File enumeration and encryption overlap, boosting throughput significantly.

This design allows Gunra to encrypt hundreds of files in minutes — crucial for reducing detection and response time on compromised networks.

4. Key Storage and Naming

Gunra does not rely only on appending the encrypted key to the file. In “separate keystore mode,” it:

Computes a SHA-256 hash of the original file name.
Uses that hash to create a unique .keystore file containing the RSA-encrypted ChaCha20 key bundle.

This approach prevents filename issues and ensures deterministic mapping between encrypted files and their keys.

5. Offline Execution for Stealth

Notably, the malware performs its encryption process entirely offline:

It needs no network connection while encrypting.
No DNS, HTTP, or remote connections are initiated during encryption.
The ransomware only guides the victim to a Tor based payment portal after encryption completes via instructions in the ransom note.

This offline design improves resilience against network isolation defenses and makes early detection harder.

Ransom Note and Extortion Workflow

Once file encryption completes:

File extensions are changed to .ENCRT.
A ransom note named R3ADM3.txt is dropped in all affected directories.
Victims are directed to use Tor to reach a hidden service payment portal with hard-coded login credentials embedded in the locker.

The ransom note further intensifies pressure by threatening data leakage — a double extortion tactic common in modern ransomware campaigns.

Public Indicators and Detection Notes

While Gunra’s Windows variant uses secure random number generation APIs, researchers have observed cross-platform Linux versions using cryptographically weak random functions — potentially opening paths for brute force decryption in some cases.

Modern defensive tools are creating detection rules (such as Sigma rule sets) to spot Gunra activity based on:

Rapid creation of .ENCRT files.
Presence of the R3ADM3.txt ransom note.
High-frequency file operations and deletion of shadow copies.

Conclusion

The Gunra RaaS operation reflects how ransomware threats have matured into sophisticated “products” sold on dark web marketplaces. With an organized affiliate program and a potent hybrid encryption engine, Gunra is designed for maximum impact and minimal detection. Defenders must complement traditional signature-based defenses with behavioral monitoring, strong backups, network segmentation, and phishing resilience to effectively mitigate such threats.