Yurei Ransomware Haunts the Digital World Like a Restless Spirit

Yurei Ransomware: Emerging Go-Based Threat Targeting Sri Lanka, Nigeria, and India

Summary

Yurei ransomware, first observed on September 5, 2025, is a Go-based ransomware strain derived from the open-source Prince ransomware family. Suspected to be operated by Moroccan threat actors, it has targeted food service and manufacturing industries across Sri Lanka, Nigeria, and India.

Yurei encrypts files using the ChaCha20 algorithm and appends the .Yurei extension. Unlike more sophisticated ransomware families, Yurei does not delete Windows Volume Shadow Copies, allowing potential file recovery without ransom payment. Its darknet leak site lists confirmed victims and facilitates negotiations.

Attack Details

• First Detection: September 5, 2025.

• Attribution: Suspected Moroccan cybercriminal group.

• Initial Victims: Food manufacturing company in Sri Lanka, followed by additional victims in Nigeria and India by September 9, 2025.

• Technical Characteristics:

  • Written in Go, based on Prince ransomware with minor code alterations.

  • Uses ChaCha20 encryption, appending .Yurei extension.

  • Drops ransom note _README_Yurei.txt with instructions to access a Tor site for negotiations.

  • Continuously scans for network drives to expand its encryption scope.

• Weakness: Fails to remove Shadow Copies, allowing recovery for victims with VSS enabled. This design flaw indicates limited sophistication compared to other ransomware groups.

Recommendations

• Network Segmentation & Zero Trust: Segment networks and implement micro-segmentation to limit lateral movement. Enforce zero trust policies to validate users and devices before granting access.

• Enable and Test VSS: Configure Volume Shadow Copy Service (VSS) for automated snapshots and routinely test recovery procedures. Maintain immutable and offsite backups to ensure resilience against ransomware attacks.

• Review File Permissions: Regularly audit file system permissions, disable unnecessary file sharing, and apply access control lists (ACLs) to limit exposure.

• Prepare for Data-Theft Extortion: Encrypt sensitive data at rest and in transit, and monitor egress points for anomalous data exfiltration attempts.

Indicators of Compromise (IoCs)

SHA256 Hashes

• 49c720758b8a87e42829ffb38a0d7fe2a8c36dc3007abfabbea76155185d2902

• 4f88d3977a24fb160fc3ba69821287a197ae9b04493d705dc2fe939442ba6461

• 1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e

• 10700ee5caad40e74809921e11b7e3f2330521266c822ca4d21e14b22ef08e1d

• 89a54d3a38d2364784368a40ab228403f1f1c1926892fe8355aa29d00eb36819

• f5e122b60390bdcc1a17a24cce0cbca68475ad5abee6b211b5be2dea966c2634

• 0303f89829763e734b1f9d4f46671e59bfaa1be5d8ec84d35a203efbfcb9bb15

• afa927ca549aaba66867f21fc4a5d653884c349f8736ecc5be3620577cf9981f

• d2539173bdc81503bf1b842a21d9599948e957cadc76a283a52f5849323d8e04

• 754865527bc33305d8dc89a88ffada71fa0180fe778e2106d5faa8e7a8801220

• 84d68ba901462bb0918a852a01df885f986661954c14d9c4e8e40338df2a1cb8

• 53397d36cab0a32695a50d179f289fa61fc946591bd97355ee98d350f7652079

Filename

• _README_Yurei.txt

TOR Address

• fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd[.]onion

MITRE ATT&CK TTPs

• Execution: T1059 (Command & Scripting Interpreter), T1059.001 (PowerShell)

• Persistence: T1543 (Create or Modify System Process)

• Privilege Escalation: T1068 (Exploitation for Privilege Escalation)

• Defense Evasion: T1562 (Impair Defenses)

• Discovery: T1083 (File and Directory Discovery), T1135 (Network Share Discovery)

• Lateral Movement: T1021 (Remote Services)

• Collection: T1005 (Data from Local System)

• Command & Control: T1071 (Application Layer Protocol)

• Exfiltration: T1041 (Exfiltration Over C2 Channel)

• Impact: T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery), T1489 (Service Stop)

References

• Check Point – Yurei: The Ghost of Open-Source Ransomware

• Prince Ransomware Source – GitHub

• Hive Pro – CrazyHunter Ransomware Advisory