Yurei Ransomware Uses PowerShell to Deploy ChaCha20 File Encryption

Yurei Ransomware, first observed on 5 September 2025, is a Go-based operation identified by CPR as using ChaCha20 encryption and PowerShell commands to compromise victim systems. According to Check Point Research (CPR), the group operates on a double-extortion model, encrypting files while exfiltrating data to pressure victims for payment. The initial targets included a Sri Lankan food manufacturing company, followed by victims in India and Nigeria, demonstrating an aggressive regional expansion.

The malware appends a .Yurei extension to encrypted files and includes mechanisms such as trying to set a custom wallpaper, though a recovered PowerShell URL issue can cause the wallpaper step to fail. Researchers note that Yurei’s ransomware is derived from Prince-Ransomware code and that there are indications the threat actors may be based in Morocco, albeit with low confidence.