Yurei: The New Ransomware Group Using Open-Source Code to Target Businesses

Yurei is a newly identified ransomware group named after spirits from Japanese folklore, with its first listed victim a Sri Lankan food manufacturing company and additional victims from India and Nigeria soon appearing on its darknet leak site, according to Check Point Research. The group operates a double-extortion model, encrypting files while exfiltrating data to pressure organisations into paying, a move CPR describes as typical of modern cybercrime syndicates.

Their malware is derived with only minor modifications from Prince-Ransomware, an open-source ransomware family written in Go, and it encrypts files using the ChaCha20 algorithm with the extension .Yurei, leaving module and function names intact to aid attribution. Notably, the ransomware does not delete Windows Shadow Copies, potentially allowing victims to recover files from previous snapshots without paying, a flaw CPR highlights.

Forensic analysis suggests possible ties to Morocco, with samples uploaded to VirusTotal from that region and Arabic HTML artefacts tied to the darknet portal, alongside links to the SatanLockv2 ransomware family. The ransom note is named README_Yurei.txt and victims are instructed to negotiate via a darknet .onion chat portal, with a decryption tool promised.