yurei Ransomware
Tracked since Sep 5, 2025
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Yurei is a ransomware group first observed in September 2025 whose payload is a minimally modified fork of the open-source Prince-Ransomware, using ChaCha20 encryption and propagating across SMB shares, primarily targeting food manufacturing, transportation, and IT sectors in Sri Lanka and Nigeria.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Observed tools
Discovery Enum
Everything.exe · SoftPerfect NetScan
LOLBAS
PsExec · SDelete
Offsec
Invoke-TheHash · NetExec · Rubeus · WinPEAS
RMM-Tools
AnyDesk
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live