Gunra
Data as of September 15, 2026.
Credential exposure before the attack
11.5% of Gunra victims whose domain we can identify (6 of 52) had employee credentials leak in the 12 months before Gunra named them as a victim.
We don't know whether any of these credentials were how Gunra gained initial access.
What industries Gunra targets
Sector identified for 42 of 52 victims.
| Manufacturing | 13 | |
| Financial Services | 7 | |
| Healthcare | 7 | |
| Legal | 4 | |
| Construction | 3 | |
| Logistics | 3 | |
| Education | 2 | |
| Real Estate | 1 |
Where the victims are located
Country identified for 39 of 52 victims.
| South Korea | 6 | |
| Brazil | 5 | |
| Thailand | 3 | |
| United States | 3 | |
| Argentina | 2 | |
| France | 2 | |
| Canada | 2 | |
| Japan | 2 |
Most recent Gunra victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Blanco & Etcheverry blancoetcheverry.com | Legal | Not identified | Sep 7, 2026 |
| La Occidental laoccidental.com | Financial Services | Not identified | Sep 7, 2026 |
| Bombas y Motores de Honduras bomohsa.com | Manufacturing | Not identified | Aug 19, 2026 |
| All Cosmos Industries allcosmos.com | Manufacturing | Malaysia | Aug 6, 2026 |
| World Tube worldtube.co.kr | Financial Services | South Korea | Aug 5, 2026 |
| Siam Stabilizers and Chemicals sakai-ssc.com | Manufacturing | Thailand | Jul 31, 2026 |
| WEIL Hotel weilhotel.com | Hospitality | Malaysia | Jul 30, 2026 |
| Dissinger & Dissinger dissingerlaw.com | Legal | United States | Jul 17, 2026 |
| New Tiles new-tiles.com | Manufacturing | Spain | Jul 13, 2026 |
| On-us on-us.com | Not identified | Not identified | Jul 13, 2026 |
| Seguros Pirámide segurospiramide.com | Financial Services | Not identified | Jul 13, 2026 |
| Yuditec yuditec.com | Manufacturing | Not identified | Jul 13, 2026 |
| MHE9 grupomhe9.com.br | Not identified | Brazil | Jun 18, 2026 |
| Suárez & Clavera suarezyclavera.com.uy | Legal | Not identified | Jun 18, 2026 |
| Yello Media Group findyello.com | Not identified | Not identified | Jun 10, 2026 |
| Somafix somafix.fr | Construction | France | Jun 1, 2026 |
| Star Empire Group starempire.com | Not identified | United States | Jun 1, 2026 |
| Cablematic cablematic.com | Not identified | Spain | May 25, 2026 |
| Kukje Pharmaceutical kukjepharm.co.kr | Healthcare | South Korea | Apr 7, 2026 |
| ASP Crew Management Services aspships.com | Logistics | Singapore | Mar 17, 2026 |
Showing the 20 most recent of 52. Browse recent data breaches for more.
Gunra leak sites
Addresses we've seen Gunra publish victims from. Any .onion address needs the Tor Browser.
www.lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.oniongunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onion2bw7r32r5eshwk2h7uekj3lwzorxds2jyhyzqyilphid3r27x5hsf4yd.onion
Gunra questions
Is Gunra still active?
Yes. Gunra posted its most recent victim on September 7, 2026. That's 3 victims in the last 30 days.
How many victims has Gunra claimed?
Gunra has named 52 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 34 of them were posted in the last 12 months.
When did Gunra first appear?
The first victim we recorded for Gunra was posted on April 24, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Gunra target?
Manufacturing accounts for the most victims we can classify, with 13. Financial Services follows at 7. We could identify a sector for 42 of 52 victims, so treat this as the shape of the targeting rather than a full census.
Has Gunra already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.