Gunra Ransomware Recovery: Conti Code, Windows and Linux
Gunra appeared in April 2025 and is built on the Conti ransomware source code leaked in 2022, the same leak that produced several other families. It runs double extortion: data is stolen, systems are encrypted, and the victim is listed on a leak site. US agencies including CISA and the FBI, with international partners, published a joint advisory on Gunra in 2026, a sign of how active it has become.
How Gunra attacks and encrypts
Reported entry points include Fortinet FortiOS authentication bypasses (CVE-2024-55591 and CVE-2025-24472) and exposed VPN and RDP services. Gunra has both a Windows encryptor and a Linux encryptor. Both use ChaCha20 with RSA. The Linux version runs up to 100 encryption threads at once and supports partial encryption, which is aimed at large servers, storage and virtualisation hosts.
Some secondary reporting also describes a weakness in how the Linux variant generates its keys. If that is confirmed for a given sample, it may allow key recovery in some cases, and it is something we check during assessment.
What we recover in Gunra cases
Partial encryption leaves large parts of databases, virtual disks and backup files untouched. We measure exactly which regions were encrypted and rebuild SQL Server, Oracle and MySQL tables, VMware virtual disks and Veeam backup contents from what is intact. We have solved many cases like this.
Do not delete encrypted files, reinstall Linux servers or reformat storage. Keep a copy and contact us for a free assessment: we tell you exactly what is recoverable before you pay anything.
Veeam backups, SQL Server or Oracle databases encrypted by Gunra?
Ransomware groups go after the backup repository first. A .vbk or .vib file renamed by the ransomware is often not lost: large backup files are usually only partly encrypted, and the intact blocks can be verified and rebuilt into the virtual disks. The same holds for SQL Server MDF and BAK files and for Oracle datafiles and Data Pump exports: the rows the ransomware did not reach can be read directly. In real cases we rebuilt a 466 GB server disk from a 43 GB Akira-encrypted VBK, and recovered 98.8% of the rows from LockBit-encrypted SQL Server backups.
- Ransomware-encrypted Veeam VBK recovery →
- AS VBK Recovery Studio: free analysis of an encrypted VBK →
- Ransomware-encrypted SQL Server database recovery →
- AS SQL Recovery & Repair Studio: free analysis of an encrypted MDF or BAK →
- Ransomware-encrypted Oracle database recovery →
- NAS and RAID ransomware recovery →
- Ransomware-encrypted VMware VMDK recovery →
Facing this problem? Contact us now.
We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.
- ✓ Free assessment before you pay anything
- ✓ No data, no charge
- ✓ NDA on request
Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST