yurei

Executive Summary

The Yurei threat actor emerged in September 2025 as a ransomware group targeting critical sectors such as food manufacturing, transportation, and IT in Sri Lanka and Nigeria. Utilizing a modified Prince-Ransomware variant with ChaCha20 encryption, Yurei propagates via SMB shares to maximize impact. Their primary goal is financial gain through ransom payments.

Goals & Targeting

Yurei targets sectors critical to daily operations—food manufacturing and transportation—to ensure high impact and willingness to pay ransoms. The group's focus on Sri Lanka and Nigeria may indicate an initial strategic choice to exploit regions with less mature cybersecurity defenses, yet significant economic stakes in maintaining essential services. Their modus operandi suggests a goal of achieving organizational gain through financial extraction.

Yurei is a newly emerged ransomware group first identified in September 2025. The group operates with a modified Prince-Ransomware variant, leveraging ChaCha20 encryption for data protection and spreading via SMB shares to compromise internal networks. Targeting sectors like food manufacturing, transportation, and IT, Yurei focuses on regions where such disruptions can lead to significant economic impact. Their criminal motivation, coupled with the use of readily available ransomware frameworks, suggests a mid-tier operational sophistication. While their activities are still emerging, Yurei demonstrates a clear intent to maximize profit through disruption.

Key Capabilities

• Ransomware deployment
• SMB propagation
• ChaCha20 encryption implementation
• Network scanning and lateral movement

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Yurei's initial operations indicate a focus on rapid deployment and limited scope, targeting three known victims across the specified sectors. Their operational tempo suggests cautious expansion, possibly to assess victim response before scaling activities. Notable for their use of open-source frameworks and minimal modification, Yurei may aim to refine their tactics based on early successes.

IOC Patterns

• Propagation via SMB shares
• ChaCha20 encryption in ransomware payloads
• Use of modified Prince-Ransomware framework

Recommended Actions

• Implement strong SMB share permissions and disable unnecessary SMB services.
• Monitor for signs of lateral movement within networks using network segmentation.
• Educate employees on phishing and suspicious emails to mitigate potential initial access vectors.
• Encrypt sensitive data at rest and in transit with robust cryptographic measures.

Suggested Tags