Team Cymru Maps Yurei Ransomware Operators’ Toolkit and Attack Chain

Apr 1, 2026 · Original article ↗

Summary

Team Cymru analyzed files from two Yurei operator open directories, mapping likely credential use, reconnaissance, privilege escalation, persistence, defense evasion and lateral movement. The directories suggest activity in January 2026, though no new victims had been.

Key points

Team Cymru identified two open directories associated with Yurei operators between December 2025 and January 2026, then analyzed their files and related sandbox submissions.
File names led researchers to assess, with medium confidence, that stolen credentials may have been used for initial access; they also found tools for network discovery, share enumeration and sensitive-file searches.
The toolkit included Rubeus and Invoke-TheHash for credential abuse, and PsExec and Invoke-SMBExec for remote execution and lateral movement.
FixingIssues2.ps1 attempts to disable Windows Defender protections, delete shadow copies and disable System Restore.
Vecna.ps1 uses a WMI trigger to launch StrangerThings.exe at explorer.exe startup; researchers identified that binary as Yurei ransomware written in Go.
The server also contained SDelete, which could be used to hinder recovery or remove forensic evidence. Researchers could not recover w.exe to determine whether it was an Akira sample.
RansomwareLive's analysis found three victims listed on the Yurei leak site since it appeared in September 2025; no victims had been posted since September, although the open directories may indicate operator activity in January 2026.

Article Details

Attack Vectors: The operators likely used stolen credentials for initial access; this assessment is based on ZIP filenames suggesting infostealer logs or credential databases and is stated with medium confidence.
Network discovery and enumeration used SoftPerfect NetScan, NetExec, Everything.exe, and the Host_Discovery.ps1 script to identify servers, enumerate shares and users, and search for sensitive files.
Rubeus was present for Kerberos-related activity, including AS-REP Roasting and Kerberoasting; Invoke-TheHash.ps1 supported pass-the-hash tasks.
Persistence tooling included AnyDesk and a WMI trigger created by Vecna.ps1 to run StrangerThings.exe when explorer.exe starts.
FixingIssues2.ps1 attempted to weaken Windows security protections, exclude paths and execution engines, delete shadow copies, and disable System Restore through Registry changes.
PsExec and Invoke-SMBExec.ps1 were present for remote execution and movement to other systems.
StrangerThings.exe was identified as Yurei ransomware; it encrypts files and drops README_Yurei.txt. The operators also ran a Tor data leak site for double extortion.
Defensive Notes: The article recommends using threat-hunting efforts to track tools listed in the Ransomware Tool Matrix and focus on what to block, detect, and hunt for.
The article describes proactive internet telemetry and targeted open-port scanning as ways to identify live assets and operational infrastructure.
Investigate suspected use of stolen credentials, credential-theft tooling, remote execution utilities, and scripts that disable security protections or delete recovery data.

Indicators of compromise

Type	Indicator	Context
IPV4	`44[.]210[.]101[.]86`	Yurei operator server hosting an open directory, observed by Team Cymru.
IPV4	`44[.]223[.]40[.]182`	Yurei operator server hosting an open directory, observed by Team Cymru.
SHA256	`1facf7cdd94eed0a8a11b30f4237699385b20578339c68df01e542d772ccbce5`	Hash of Host_Discovery.ps1, an internal enumeration script found on the Yurei operator server.
SHA256	`26f51df1a12230b6bb583f3003c102a79106b049f89d9b9d43c6e85e072bd99e`	Hash of Vecna.ps1, the script reported to establish persistence by executing StrangerThings.exe.
SHA256	`4f88d3977a24fb160fc3ba69821287a197ae9b04493d705dc2fe939442ba6461`	Hash of StrangerThings.exe, identified as a Yurei ransomware binary.
SHA256	`ebfe75ab3223b036a4b886d497f2b172425b3e63890d485c99353773d4c436ea`	Hash of FixingIssues2.ps1, a script found on the Yurei operator server that attempts to disable security protections and remove recovery options.