Bearlyfy

Three distinct threat groups—NightEagle, Hacking Cat, and Toy Ghouls—are targeting Russian enterprises using backdoors, ransomware, and wipers. NightEagle exploits vulnerabilities like CVE-2019-0708 and CVE-2020-0688 to deploy the GhostContainer backdoor on Microsoft Exchange servers, enabling code execution and lateral movement. Hacking Cat, a pro-Ukrainian hacktivist group, uses Gorilla RAT and multiple variants of Monkey ransomware written in different languages, along with wiper malware Nemo Wiper, often in collaboration with other groups. Toy Ghouls has shifted to custom tools, deploying a new backdoor called Bird Agent that uses HiveMQ MQTT or Element (Matrix) for C2 communication, delivered via WinRM using tools like Evil-WinRM.

The GenieLocker ransomware, attributed to the financially motivated threat actor Toy Ghouls (also known as Bearlyfy, Labubu, Laboo.boo), has been active since March 2026 and targets organizations primarily in the Russian Federation, especially in the manufacturing sector. The ransomware is a custom-built encryption Trojan with variants for Windows, Linux, and ESXi, reducing the group's reliance on third-party ransomware. It uses stolen credentials via an OpenVPN connection for initial access, conducts discovery and credential dumping using tools like Mimikatz, moves laterally via RDP and SSH, and deploys the ransomware using PsExec and PAExec. The malware encrypts files using XChaCha20-Poly1305 and stores encrypted keys protected with Curve25519-XSalsa20-Poly1305, with no evidence of data exfiltration, indicating a single-extortion model.