{"id":6922,"date":"2025-09-15T10:03:28","date_gmt":"2025-09-15T10:03:28","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/09\/15\/new-yurei-ransomware-with-powershell-commands-encrypts-files-with-chacha20-algorithm\/"},"modified":"2025-09-15T10:03:28","modified_gmt":"2025-09-15T10:03:28","slug":"new-yurei-ransomware-with-powershell-commands-encrypts-files-with-chacha20-algorithm","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/09\/15\/new-yurei-ransomware-with-powershell-commands-encrypts-files-with-chacha20-algorithm\/","title":{"rendered":"New Yurei Ransomware With PowerShell Commands Encrypts Files With ChaCha20 Algorithm"},"content":{"rendered":"

New Yurei Ransomware With PowerShell Commands Encrypts Files With ChaCha20 Algorithm
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Emerging in early September 2025, the Yurei ransomware has swiftly drawn attention for its novel combination of Go-based execution and ChaCha20 encryption.<\/p>\n

First documented on September 5 when a Sri Lankan food manufacturer fell victim, the threat actor behind Yurei adopted a double-extortion model: encrypting files while exfiltrating sensitive data<\/a> for additional leverage.<\/p>\n

Within days, two more victims in India and Nigeria were publicly listed, underscoring the operator\u2019s rapid expansion.<\/p>\n

Unlike many sophisticated groups that develop custom toolsets, Yurei\u2019s codebase traces back to the open-source Prince-Ransomware project, raising questions about the skill level and resources of the attackers.<\/p>\n

At its core, Yurei leverages Go\u2019s concurrency features to enumerate all drives in parallel and encrypt files with the ChaCha20 algorithm.<\/p>\n

For each file, a new random ChaCha20 key and nonce are generated, then encrypted using ECIES with the attacker\u2019s public key.<\/p>\n

The resulting ciphertext, key, and nonce are concatenated with delimiters:-<\/p>\n

\/\/ Generate random key and nonce\nkey := generateChaCha20Key()\nnonce := generateNonce()\n\/\/ Encrypt file content\nencryptedData := chaCha20Encrypt(content, key, nonce)\n\/\/ Protect key and nonce with ECIES\nprotectedKey := eciesEncrypt(key, publicKey)\nprotectedNonce := eciesEncrypt(nonce, publicKey)\n\/\/ Store encrypted file\nstore := protectedKey + \"||\" + protectedNonce + \"||\" + encryptedData<\/code><\/pre>\n
Check Point researchers noted<\/a> that Yurei retains symbols in the binary, a mistake inherited from the Prince-Ransomware builder, which did not strip debugging information.<\/p>\n
This oversight provided analysts with clear function names such as Yurei_encryption_generateKey<\/code> and Yurei_filewalker_EncryptAllDrivesAndNetwork<\/code>, streamlining the reverse-engineering process.<\/p>\n
Shadow Copy Recovery and Defensive Implications<\/strong><\/h2>\n
Despite this, Yurei\u2019s use of Go complicates detection for some legacy antivirus products, illustrating how language choice can impact defensive measures<\/a>.<\/p>\n
\n
\"\"
Yurei ransomware site on September 5 (Source \u2013 Check Point)<\/figcaption><\/figure>\n<\/div>\n
Following successful encryption, Yurei attempts to set a custom wallpaper via PowerShell<\/a>, though the absence of a valid URL causes the command to fail, resulting in a blank background.<\/p>\n
The embedded PowerShell snippet mirrors that of its Prince-Ransomware predecessor:-<\/p>\n
(New-Object System.Net.WebClient).DownloadFile('<WallpaperURL>', \"$env:TEMPWallpaper.png\")\nAdd-Type -TypeDefinition @\"\nusing System;\nusing System.Runtime.InteropServices;\npublic class Wallpaper {\n    [DllImport(\"user32.dll\", CharSet=CharSet.Auto)]\n    public static extern bool SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);\n}\n\"@\n[Wallpaper]::SystemParametersInfo(20, 0, \"$env:TEMPWallpaper.png\", 3)<\/code><\/pre>\n
\n
\"\"
Ransom note (Source \u2013 Check Point)<\/figcaption><\/figure>\n<\/div>\n
In the context of defensive strategies, Yurei\u2019s failure to remove Volume Shadow Copies reveals a critical weakness.<\/p>\n
Organizations with VSS enabled can recover files without paying ransom, although leaked data remains at risk.<\/p>\n
The combination of rapid encryption, data exfiltration<\/a>, and half-baked persistence techniques reflects a low-effort but effective operation.<\/p>\n
As Yurei continues targeting diverse sectors, security teams are urged to monitor for the distinct file extension .Yurei<\/code>, enforce strict egress controls, and validate VSS snapshots to mitigate the impact of this emerging threat.<\/p>\n
Boost\u00a0your\u00a0SOC and help your team protect your business with free top-notch threat intelligence:\u00a0Request TI Lookup Premium Trial<\/a>.<\/code><\/strong><\/p>\n
The post New Yurei Ransomware With PowerShell Commands Encrypts Files With ChaCha20 Algorithm<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
New Yurei Ransomware With PowerShell Commands Encrypts Files With ChaCha20 Algorithm Emerging in early September 2025, the Yurei ransomware has swiftly drawn attention for its novel combination of Go-based execution and ChaCha20 encryption. First documented on September 5 when a Sri Lankan food manufacturer fell victim, the threat actor behind Yurei adopted a double-extortion model: […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-6922","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6922"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6922"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6922\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6922"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}