Skip to main content
Darkfield

Operator dossier

yurei is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 3 public victims claimed by this operator between September 5, 2025 and September 9, 2025. Yurei is an emerging ransomware group first observed in September 2025, operating with apparent financial motivations based on their targeting patterns and victim selection. The group's origin and potential affiliations remain unclear due to limited public documentation, though their diverse geographical targeting across Switzerland, Sri Lanka, and Nigeria suggests either opportunistic attacks or access to varied initial compromise vectors. Given the recent emergence and limited intelligence available, their attack methodology, specific tools, and encryption techniques have not been extensively documented by major security firms or government agencies. The group appears to focus on energy sector targets where data is available, though their small victim count of three documented cases suggests they are either highly selective, newly operational, or operating below the radar of major threat intelligence providers. Yurei remains active as of their recent emergence, though the limited public intelligence makes it difficult to assess their operational tempo, sophistication level, or long-term persistence in the ransomware landscape.

Most-targeted sectors

Most-affected countries

Recent disclosures by yurei

All 3 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for yurei →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

yurei

3 victims indexed · first seen 10 months ago · last activity 10 months ago

3
Victims indexed
#280 of 364 tracked operators
<1m
Active period
Sep 2025 → Sep 2025
3
Countries hit
top CH · 1

At a glance

Status
inactive
First seen
10 months ago
Last activity
10 months ago
Onion sites
1 known endpoint
Primary sector
Not Found · 2 hits

About

Yurei is an emerging ransomware group first observed in September 2025, operating with apparent financial motivations based on their targeting patterns and victim selection. The group's origin and potential affiliations remain unclear due to limited public documentation, though their diverse geographical targeting across Switzerland, Sri Lanka, and Nigeria suggests either opportunistic attacks or access to varied initial compromise vectors. Given the recent emergence and limited intelligence available, their attack methodology, specific tools, and encryption techniques have not been extensively documented by major security firms or government agencies. The group appears to focus on energy sector targets where data is available, though their small victim count of three documented cases suggests they are either highly selective, newly operational, or operating below the radar of major threat intelligence providers. Yurei remains active as of their recent emergence, though the limited public intelligence makes it difficult to assess their operational tempo, sophistication level, or long-term persistence in the ransomware landscape.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2025-09-01T00:00:00+00:00 · 3
2025-09-01T00:00:00+00:002025-09-01T00:00:00+00:00

Top countries

🇨🇭 Switzerland
1
🇱🇰 Sri Lanka
1
🇳🇬 Nigeria
1
Switzerland dossier →Sri Lanka dossier →Nigeria dossier →

Top sectors

Energy
1
Energy dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onion

Source

Updated 10 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time yurei posts a victim.

Add yurei to your watchlist — Pro pings you within 5 minutes of any new yurei leak-site post, Telegram callout, or affiliate-rebrand inference.