Stranger Strings: Yurei Ransomware Operator Toolkit Exposed Yurei is a double-extortion ransomware campaign active since September 2025 that appears derived from the open-source Prince Ransomware and contains references to SatanLockv2; researchers found samples first submitted from Morocco and a Tor leak site with only a few victims. Team Cymru discovered open directories on 44.210.101[.]86 and 44.223.40[.]182 hosting a...

Yurei ransomware, active since Sept 2025 and linked to Prince Ransomware, uses double extortion and includes tools like PowerShell scripts and StrangerThings.exe. Samples first found in Morocco. #YureiThreat #RansomwareToolkits #Morocco