Yurei – A Sophisticated “Ghost” Ransomware Capable of Irreversible Data Destruction

• 08/10/2025

A new ransomware variant named Yurei (meaning “Ghost” in Japanese) has recently been discovered, drawing significant attention from the cybersecurity community due to its powerful encryption, fast propagation, and complete self-erasure after execution.
According to security researchers, Yurei is considered one of the most advanced and destructive ransomware campaigns recorded to date.



 

Irreversible Encryption and Forensic-Resistant Behavior

Yurei is written in the Go programming language, favored by attackers for its cross-platform compatibility and efficient parallel processing.
Once executed, Yurei encrypts each file individually using the ChaCha20 algorithm, and then secures the key with the attacker’s ECIES public key — making data recovery virtually impossible without the private decryption key.

Beyond encryption, Yurei also performs a series of anti-forensic and data destruction actions, including:

• Deleting all shadow copies and system backups

• Overwriting event logs and removing executable traces

• Self-destructing by overwriting its own binary three times with cryptographically secure random bytes before renaming and deleting itself

Multi-Vector Attack and Rapid Propagation

Yurei is designed for lateral movement within enterprise networks, spreading through multiple channels such as:

• SMB shares (disguised as System32_Backup.exe)

• USB drives (masked as WindowsUpdate.exe)

• Remote execution via PsExec and CIM

This multi-vector approach allows Yurei to silently spread across networks and physical devices, posing a severe threat to organizations lacking continuous monitoring and access control.

After encryption is complete, Yurei drops a ransom note named _README_Yurei.txt in every directory, informing victims that:

• Their systems have been fully compromised

• Backup data has been destroyed

• Data will be leaked if ransom is not paid in time

Attackers even offer a “24-hour trial decryption” and provide a unique victim ID for negotiation via the Tor network.

Evidence of Code Reuse from Open-Source Ransomware

Technical analysis reveals strong similarities between Yurei and Prince Ransomware, an open-source project available on GitHub.
Artifacts such as PrinceCrypto.dll, InitPrinceKeys(), and the ChaCha20 + ECIES encryption model suggest that Yurei was built upon Prince’s source code, but enhanced for speed and stealth by leveraging Go’s concurrency capabilities.

First Victims Identified

The first known Yurei sample was detected on September 5, 2025, targeting a food manufacturing company in Sri Lanka.
Subsequent infections have been reported in Germany, Turkey, and Morocco, indicating a rapidly expanding global campaign.

Despite its Japanese name, there is no evidence linking the attackers to Japan. Compilation data revealed references to the user “intellocker” and path D:\satanlockv2, hinting at potential ties to the older SatanLockerV2 ransomware.

DTG Experts Warn: Prevention Is the Strongest Defense

According to DTG cybersecurity experts, recovering encrypted data after a Yurei attack is virtually impossible.
Organizations must therefore focus on proactive defense and resilience, rather than reactive incident handling.