MalwarePublished 4 Oct 2025Updated 6 Oct 2025

YUREI RANSOMWARE: THE DIGITAL GHOST

Source AlienVault OTX General

Description

A sophisticated ransomware family called Yurei has emerged, targeting Windows systems with advanced encryption methods. It rapidly encrypts data using ChaCha20 and ECIES, appends .Yurei to files, and disables recovery options. The malware spreads via SMB shares, removable drives, and credential-based remote execution. It employs anti-forensics techniques, including log wiping and secure deletion. Yurei features double-extortion capabilities, threatening data leaks alongside ransom demands. Analysis suggests possible code reuse from the Prince ransomware. The ransomware's professional build, stealthy propagation, and high operational speed make it a significant threat designed for irreversible data compromise.

Impact

For European organizations, especially those in Germany where infections have been identified, Yurei ransomware poses a significant threat to data confidentiality, integrity, and availability. The rapid encryption and disabling of recovery options can cause severe operational disruptions, data loss, and financial damage. The double-extortion component increases reputational risk and regulatory exposure under GDPR due to potential data leaks. Organizations with extensive SMB network shares or reliance on removable media are particularly vulnerable to lateral spread. The anti-forensics features complicate incident response and forensic investigations, potentially prolonging downtime and recovery efforts. Critical infrastructure, manufacturing, healthcare, and financial sectors in Europe could face heightened risks given their reliance on Windows systems and interconnected networks. The threat also raises concerns about supply chain security and insider threats due to credential-based propagation. Overall, Yurei could cause substantial economic and operational impacts if not mitigated promptly.

Defensive guidance

1. Implement strict network segmentation and limit SMB share access to only necessary users and systems, employing least privilege principles. 2. Enforce multi-factor authentication (MFA) for all remote access and credential usage to reduce risk of credential-based execution. 3. Disable or restrict use of removable drives where possible, or enforce strict scanning and control policies. 4. Deploy advanced endpoint detection and response (EDR) solutions capable of detecting the specific Yurei indicators such as file hashes and Yara rules. 5. Monitor and alert on suspicious activities including log wiping, secure deletion attempts, and unusual SMB traffic patterns. 6. Maintain offline, immutable backups and regularly test recovery procedures to ensure resilience against ransomware encryption and recovery option disabling. 7. Conduct regular user training focused on phishing and credential security to reduce initial infection vectors. 8. Apply the principle of least privilege to service accounts and disable unnecessary Windows Management Instrumentation (WMI) and remote execution capabilities. 9. Collaborate with threat intelligence sharing platforms to stay updated on Yurei developments and IoCs. 10. Prepare incident response plans specifically addressing double-extortion ransomware scenarios, including legal and communication strategies.

Indicators of compromise

Domains 1

fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onion

Hashes 5

964540e24c4e2e048e4600e5f590bf96
d4757f035c3447c33c2347101d08c1e798f1a044
1263280c916464c2aa755a81b0f947e769c8a735a74a172157257fca340e1cf4
4f88d3977a24fb160fc3ba69821287a197ae9b04493d705dc2fe939442ba6461
b5068f523f56b33b5665f3ae177c985502dc237c

Yara 1

Detects Yurei ransomware samples using SHA256 hashes or associated strings/IOCs

b5068f523f56b33b5665f3ae177c985502dc237c

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Oct 2025, 08:13 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 5

Yara 1

Community reviews

Related threats