yurei

Yurei is an emerging ransomware group first observed in September 2025, operating with apparent financial motivations based on their targeting patterns and victim selection. The group's origin and potential affiliations remain unclear due to limited public documentation, though their diverse geographical targeting across Switzerland, Sri Lanka, and Nigeria suggests either opportunistic attacks or access to varied initial compromise vectors. Given the recent emergence and limited intelligence available, their attack methodology, specific tools, and encryption techniques have not been extensively documented by major security firms or government agencies. The group appears to focus on energy sector targets where data is available, though their small victim count of three documented cases suggests they are either highly selective, newly operational, or operating below the radar of major threat intelligence providers. Yurei remains active as of their recent emergence, though the limited public intelligence makes it difficult to assess their operational tempo, sophistication level, or long-term persistence in the ransomware landscape.