Yurei Ransomware File Encryption, Operation Model and Data Transfer Methods Uncovered

A new threat has emerged in the ransomware landscape with the discovery of Yurei ransomware, first publicly identified in early September 2025.

This Go-based malware follows a typical ransomware operation model by infiltrating corporate networks, encrypting critical data, deleting backups, and demanding ransom for stolen information.

The group operates through a dedicated dark web site where they contact victims and negotiate payment terms based on the financial status of each targeted company.

The known victims of Yurei ransomware attacks include organizations in Sri Lanka and Nigeria, with primary targets in transportation and logistics, IT software, marketing and advertising, and food and beverage industries.

Unlike many modern ransomware operations, there is no clear evidence linking Yurei to Ransomware as a Service models or collaboration with other cybercrime groups.

The threat actors calculate ransom demands on a case-by-case basis after reviewing the victim’s financial position, though specific ransom amounts have not been publicly disclosed.

ASEC security researchers identified that Yurei ransomware stands out for its sophisticated encryption approach.

The malware uses the ChaCha20-Poly1305 algorithm for file encryption, generating a 32-byte key and a 24-byte nonce as random values.

These encryption keys are then protected using the secp256k1-ECIES method with an embedded public key, ensuring only the threat actor holding the corresponding private key can decrypt files.

This dual-layer encryption design makes unauthorized decryption virtually impossible without paying the ransom.

File Encryption Mechanism

The encryption process begins with Yurei scanning the infected system to identify all available drives and potential encryption targets.

The ransomware deliberately excludes critical system directories like Windows, System32, and Program Files to prevent complete system failure.

It also skips files with extensions such as .sys, .exe, .dll, and .Yurei (its own encrypted file marker) to avoid re-encrypting already compromised files.

Files are encrypted in 64 KB block units using ChaCha20-Poly1305, with the encrypted key and nonce stored at the beginning of each file using the “||” delimiter.

The secp256k1-ECIES encryption method employed by Yurei uses Elliptic Curve Diffie-Hellman to create a shared secret, which is then transformed through a key derivation function to serve as the AES-GCM encryption key.

A randomly generated temporary nonce ensures different encryption results each time, preventing victims from attempting independent recovery.

The ransom note, saved as “_README_Yurei.txt”, threatens to delete the decryption key and leak stolen data including databases, financial documents, and personal information on the dark web if victims fail to respond within five days.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.