New Yurei Ransomware Emerges: Go-Based Variant Uses Advanced Anti-Forensics for Irreversible Double Extortion

A new ransomware variant known as Yurei Ransomware has emerged, described by CYFIRMA researchers as a polished double-extortion operation developed in Go with advanced encryption, anti-forensic, and propagation techniques. The first sample was identified on 5 September 2025, with an initial victim located in Sri Lanka’s food manufacturing sector, and CYFIRMA notes that later submissions originated from Morocco, Germany, and Turkey.

Yurei encrypts files with per-file ChaCha20 keys wrapped in the attacker’s ECIES public key, renames encrypted files with the .Yurei extension, and plants ransom notes titled README_Yurei.txt in every directory, while also deleting shadow copies, system backups, and event logs to hinder restoration.

It spreads across networks using SMB shares, removable drives, and credential-based remote execution (including PsExec and CIM sessions), and disguises itself as WindowsUpdate.exe on USB drives while using writable SMB shares as System32_Backup.exe for persistence. The malware stages its payload from temporary directories, deploys ransom notes with Tor-based contact channels, and invokes anti-forensic routines including a selfDestruct function that overwrites memory and securely deletes binaries. CYFIRMA emphasises the operation’s focus on rapid payment, total compromise, and potential data leakage if no ransom is paid promptly.