Yurei Ransomware leverages SMB shares and removable drives to Encrypt Files

Yurei Ransomware targets Windows systems and propagates by exploiting SMB shares and removable media, rapidly encrypting data on all accessible local, network, and removable drives using per-file ChaCha20 keys wrapped with an attacker’s ECIES public key. Encrypted files receive the .Yurei extension, and each directory drops a ransom note named _README_Yurei.txt with Tor-based contact channels.

According to CYFIRMA, the new ransomware strain is developed in Go and has circulated in multiple malware repositories, with first seen on 5 September 2025 and an initial victim described as a Sri Lankan food manufacturer. The malware stages in temporary directories, disables backups and logs, and uses self-cleaning routines to hinder forensic analysis, including PowerShell commands to remove Volume Shadow Copies and backup catalogs.

For lateral movement, Yurei employs PSCredential objects, CIM sessions, and net use or PsExec-style remote execution to infect networked hosts, while its stealthPropagation routine copies itself to SMB share roots and targets removable drives as WindowsUpdate.exe. It then overwrites traces and memory and wipes console history to complicate investigations.