// THREAT ACTOR
YUREI_
DormantYUREI is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of YUREI — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2025 3
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onionYurei Blog snapshot · 2025-09-12 13:18
Recent victims
The 50 most recent victims claimed by YUREI. Total in the index: 3.
| Date listed | Victim | Description |
|---|---|---|
| 2025-09-09 | noblecorp.net | Noble Corporation is a leading industrial insulation and materials sup… |
| 2025-09-08 | www.thepromisenig.com | The Promise Nigeria Ltd is a leading brand in Nigeria’s fast-food and … |
| 2025-09-05 | www.midcity.lk | Midcity Marketing (Pvt) Ltd, Sri Lanka is a dominant force in the impo… |