Ransomware Group
Yurei
Yurei is a ransomware group first observed in September 2025 whose payload is a minimally modified fork of the open-source Prince-Ransomware, using ChaCha20 encryption and propagating across SMB shares, primarily targeting food manufacturing, transportation, and IT sectors in Sri Lanka and Nigeria.
Known victims3
Threat level
LOW
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
DiscoveryEnum
- Everything.exe
- SoftPerfect NetScan
LOLBAS
- PsExec
- SDelete
Offsec
- Invoke-TheHash
- NetExec
- Rubeus
- WinPEAS
RMM-Tools
- AnyDesk
Known infrastructure
The following Tor hidden services have been associated with this group:
Yurei Blog
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Yurei’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request