ransomware

Gunra

active · last signal 5mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

Golden Community

Attribution

Financially motivated ransomware-as-a-service (RaaS) operation. No confirmed nation-state attribution. Reporting links Gunra's Windows encryptor to the leaked Conti ransomware source code, placing it in the post-Conti lineage alongside families such as Black Basta and Rhysida. The FBI-led joint advisory notes the operators rebranded under the alias 'Golden Community' while building out an affiliate program.

First seen

2025-04

Last active

2026-09

Motivation

Financial (double-extortion ransomware; data theft plus encryption for extortion)

Attribution confidence

medium

MENA targeting

UAE, Egypt

Sectors

Healthcare, manufacturing, professional services

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting UAE, Egypt (Healthcare, manufacturing, professional services sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

BrainCipheractorTechnique overlap
SinobiactorTechnique overlap
BianLianactorTechnique overlap
CactusactorTechnique overlap
NovaactorTechnique overlap
DevmanactorTechnique overlap
StormousactorTechnique overlap
RhysidaactorTechnique overlap
Money Messageactor

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Gunra's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

11 / 16

Mean robustness (of covered)

2.1

Claimed victims · 1 tracked

Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches. Metadata only. MENA Ransomware Watch →

Claim volume · last 12 months

ONDJFMAMJJAS

Date	Victim	Country	Sector

Useful?