Yurei emerged as a ransomware group on September 5, 2025, operating a double-extortion model where they encrypt victim files and exfiltrate sensitive data to demand ransom. The group is assessed with moderate confidence to be of Moroccan origin, based on early malware submissions. Yurei distinguishes itself by leveraging a minimally modified, open-source ransomware codebase, Prince-Ransomware, which allows even less-skilled threat actors to conduct operations. A key characteristic is its initial oversight in failing to delete Volume Shadow Copies, a common ransomware technique, though later reports indicate the use of tools like SDelete for this purpose, alongside deploying "Stranger Things" themed tooling.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker