New Yurei Ransomware Emerges: Go-Based Threat Uses ChaCha20-Poly1305 for Irreversible Double Extortion

According to AhnLab, Yurei is a newly emerging Go-based ransomware strain first observed in early September 2025, operating with a classic double-extortion model that encrypts data, deletes backups and threatens to leak stolen information. The malware uses a dual-layer cryptographic approach, combining ChaCha20-Poly1305 for fast file encryption with secp256k1-ECIES to secure the encryption keys, and it generates a 32-byte key and a 24-byte nonce that are themselves encrypted and stored inside the encrypted file.

Notably, Yurei is designed to avoid destabilising the victim’s system by excluding numerous directories, file types and specific files from encryption. Security researchers say the threat is written in Go and performs encryption with minimal preparation, collecting drive information and scanning all accessible storage paths.

Victims have been targeted in Sri Lanka and Nigeria across transportation and logistics, IT software, marketing and advertising, and food and beverage sectors, with attackers claiming to have breached infrastructure, deleted backups and stolen data, and warning that failure to respond within five days could lead to data leakage. The group appears to operate independently, with no clear evidence of RaaS involvement or collaboration with other groups, according to AhnLab.