Yurei & The Ghost of Open Source Ransomware

Yurei, a newly emerged ransomware group, was first observed on 5 September and listed a Sri Lankan food manufacturing company as its initial leaked victim, operating under a double-extortion model that encrypts files and exfiltrates data before demanding payment to decrypt and avoid publication.

CPR determined that Yurei’s ransomware is largely based on an open-source project named Prince-Ransomware, written in Go, with only minor modifications, illustrating how open-source malware can lower the entry barrier for criminals. The operation has expanded quickly, with the number of victims rising to three as of 9 September, including entries from India and Nigeria alongside the initial victim.

A notable flaw is that Yurei does not delete Shadow Copies, meaning victims may restore files from previous snapshots if VSS is enabled, though data-theft-based extortion remains the primary pressure point. Tracing the threat actor’s origins produced hints of Morocco, with low confidence, as samples and local path artifacts pointed to that region.