Toy Ghouls’ new toy: the GenieLocker ransomware

The GenieLocker ransomware, attributed to the financially motivated threat actor Toy Ghouls (also known as Bearlyfy, Labubu, Laboo.boo), has been active since March 2026 and targets organizations primarily in the Russian Federation, especially in the manufacturing sector. The ransomware is a custom-built encryption Trojan with variants for Windows, Linux, and ESXi, reducing the group's reliance on third-party ransomware. It uses stolen credentials via an OpenVPN connection for initial access, conducts discovery and credential dumping using tools like Mimikatz, moves laterally via RDP and SSH, and deploys the ransomware using PsExec and PAExec. The malware encrypts files using XChaCha20-Poly1305 and stores encrypted keys protected with Curve25519-XSalsa20-Poly1305, with no evidence of data exfiltration, indicating a single-extortion model.

AI-extracted · verify before operational use