Stranger Strings: Yurei Ransomware Operator Toolkit Exposed

Active since September 2025, Yurei is a double extortion ransomware campaign. The operators run their own Tor data leak site with a low number of victims listed at the time of writing. It is reportedly derived from Prince Ransomware, an open-source ransomware family written in Go. Check Point researchers noted that all samples were first submitted to VirusTotal from Morocco, and that one sample did not include a ticket ID, indicating that this could be a test build, possibly uploaded by the developer themselves. Yurei ransomware samples also contained a link to SatanLockv2, based on the presence of the PDB path string “D:\satanlockv2” present in the Yurei samples.

• INC and The Gentlemen Ransomware: Exposed AI InfrastructureMalware2026-10-21
• Samsung MagicINFO 9 Server · The Not So Silent Miner: Threat Actor Compiles Cryptominer on the EndpointExploitedMalware2026-09-24
• The Tale of Two INC Ransom Notes: A Ransomware TimelineMalware2026-09-21
• Inside Kimsuky's Abuse of Legitimate Remote Control Tools Across Northeast AsiaCampaign2026-08-20
• Hits Safe Mode: Ransomware Rebooting Around EDRMalware2026-08-12