yurei
Activity analysis
HackerFeeds has tracked 3 victims claimed by yurei since September 2025 — ranking #285 of 332 groups (0% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in September 2025. Its most-targeted sector is Energy (1 victims), followed by Consumer Services (1). Nigeria accounts for 1 victims (33% of those with a known location).
Victims per year
- 20253
Top sectors
- Energy1
- Consumer Services1
- Agriculture and Food Production1
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Yurei is a ransomware group first observed in September 2025 whose payload is a minimally modified fork of the open-source Prince-Ransomware, using ChaCha20 encryption and propagating across SMB shares, primarily targeting food manufacturing, transportation, and IT sectors in Sri Lanka and Nigeria.
Recent victims
| Date | Website / victim | Sector | Country |
|---|---|---|---|
| 2025-09-09 |  noblecorp.netnoblecorp.net | Energy & Utilities | CH |
| 2025-09-08 |  www.thepromisenig.comwww.thepromisenig.com | Retail & E-Commerce | NG |
| 2025-09-05 |  www.midcity.lkwww.midcity.lk | Agriculture and Food Production | LK |