Gunra is a Conti-derived ransomware-as-a-service that employs double extortion, encrypting victim data with ChaCha20 + RSA-4096 and threatening to publish exfiltrated data on a Tor-based leak site. The actors gain initial access primarily by exploiting authentication bypass vulnerabilities (CVE-2024-55591, CVE-2025-24472) in FortiOS and FortiProxy devices, then use Impacket libraries, Mimikatz, and credential dumping for lateral movement and privilege escalation. The ransomware targets both Windows and Linux environments, with the Linux variant containing a weak PRNG flaw that may allow file recovery without paying ransom.
double extortion
2 posts
#StopRansomware: Gunra Ransomware (CVE-2024-55591, CVE-2025-24472) A Study of Thanos Ransomware Variants | Zscaler Blog Thanos ransomware, a C#/.NET-based RaaS platform whose builder source code leaked, spawned at least four double-extortion variants in 2021: Prometheus, Haron, Spook, and Midas. All variants share common signatures including the 'GotAllDone' file marker appended to encrypted files and key identifiers in ransom notes. The latest variant, Midas, terminates security and backup services, deletes shadow copies, disables the Raccine anti-ransomware tool, encrypts files using Salsa20 with RSA-wrapped keys, and maintains persistence via a startup LNK file.
