Yurei

Inactive

Yurei is a ransomware group first observed in September 2025 whose payload is a minimally modified fork of the open-source Prince-Ransomware, using ChaCha20 encryption and propagating across SMB shares, primarily targeting food manufacturing, transportation, and IT sectors in Sri Lanka and Nigeria.

3 Victims

Sep 5, 2025 First Discovered

Sep 9, 2025 Last Discovered

417 Days Inactive

0% Infostealer

0/1 Sites Online

Known Locations (1)

Yurei Blog

fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onion

Tools Used

DiscoveryEnum

Everything.exe, SoftPerfect NetScan

LOLBAS

PsExec, SDelete

Offsec

Invoke-TheHash, NetExec, Rubeus, WinPEAS

RMM-Tools

AnyDesk

Victims (3)

Detailed victim list temporarily unavailable

This group has 3 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.