GenieLocker Ransomware Targets Multiple Systems

Recently, a new ransomware named GenieLocker has emerged, posing significant threats to systems running Windows, Linux, and VMware ESXi. This ransomware is primarily associated with the Toy Ghouls group, a financially-driven cybercrime organization also recognized by other aliases such as Bearlyfy and Labubu. The primary focus of these attacks has been within Russia’s manufacturing sector since March 2026.

Transition to Homegrown Ransomware

The Toy Ghouls group, previously known for utilizing ransomware strains like LockBit, Babuk, and RedAlert, has shifted to their own creation, GenieLocker. This change grants the group more autonomy over their malicious activities, reducing reliance on third-party malware tools. The move towards GenieLocker signifies a strategic evolution in their operational tactics.

In a notable incident in late March, attackers exploited an OpenVPN connection from an external partner’s network, using legitimate but compromised credentials. This breach capitalized on the trust between the victim and its partner to gain initial network access.

Technical Deployment and Lateral Movement

Once inside, the attackers deployed various tools such as OpenSSH, socks5.exe, SoftPerfect Network Scanner, and Mimikatz. These tools facilitated system mapping and credential harvesting. Additionally, they accessed KeePassXC password managers to extract stored credentials, enabling further lateral movement across Windows systems via Remote Desktop Protocol and Linux hosts through SSH.

For spreading the ransomware, PsExec and PAExec were utilized alongside a reverse SSH tunnel to maintain a connection with their command center. Written predominantly in C and compiled with Microsoft Visual C++ libraries, the Windows variant of GenieLocker includes sophisticated anti-debugging measures to thwart analysis attempts.

Encryption Process and Mitigation Strategies

Before encryption, GenieLocker terminates processes linked to databases, security tools, and virtual machines to minimize interference. It uses the libsodium cryptographic library for file encryption, with sophisticated key protection mechanisms involving Curve25519-XSalsa20-Poly1305.

The Linux and ESXi versions, while less complex, still pose significant threats, particularly to virtualized environments by stopping virtual machines and encrypting their disks. Unlike other ransomware groups, the Toy Ghouls have not yet adopted double extortion tactics or public data leaks.

Protective Measures and Recommendations

Organizations are advised to scrutinize VPN access controls, revoke outdated partner credentials, and monitor tools like PsExec and Mimikatz for suspicious activities. Ensuring that backups are secure from both Windows and ESXi attacks is crucial. Strengthening Security Operations Centers (SOC) with rapid threat detection capabilities can mitigate the risks posed by such sophisticated ransomware attacks.