GenieLocker ransomware has emerged as a major threat since March 2026, targeting Windows, Linux and VMware ESXi systems. The Toy Ghouls group, also known as Bearlyfy, Labubu and Laboo.boo, has deployed this custom malware in attacks primarily against manufacturing organisations. The group’s use of GenieLocker marks a shift from leveraging third-party ransomware to their own sophisticated tool, introducing significant risks to environments with remote partner access and virtualised infrastructure.
GenieLocker ransomware: event timeline and attack summary
According to Kaspersky, Toy Ghouls launched attacks using GenieLocker from late March 2026, with activity observed as ongoing. The group previously relied on RedAlert, LockBit and Babuk ransomware but now deploys their own malware, reducing dependence on external developers. In a key incident documented by Kaspersky, the attackers gained entry to a target organisation via an OpenVPN connection from an external partner network. The attackers used stolen but valid credentials, exploiting the trust relationship between the victim and their partner.
- Late March 2026: OpenVPN access from partner network, initial compromise observed.
- 27 March 2026: Public reporting links Bearlyfy to GenieLocker ransomware.
- 30 July 2026: Kaspersky publishes a technical breakdown of GenieLocker activity.
The group targeted systems running Microsoft Windows, Linux servers and VMware ESXi hypervisors, using both PE (Windows) and ELF (Linux, ESXi) builds of GenieLocker. The malware was deployed en masse across compromised environments, including virtualised workloads, leading to widespread encryption and operational disruption.
Attack mechanics: from intrusion to encryption
GenieLocker’s attack chain demonstrates a deep understanding of enterprise environments and remote access mechanisms. The threat actor’s tactics, techniques and procedures (TTPs) have been mapped in detail by Kaspersky’s incident response team.
Initial access and discovery
The intrusion began with the attackers leveraging a legitimate OpenVPN connection, originating from a trusted third-party. Using stolen credentials, they accessed the victim’s internal network without raising immediate suspicion. This method underscores the risks posed by poorly monitored or overly permissive partner remote access.
- Tools observed: SoftPerfect Network Scanner for network reconnaissance, Mimikatz for credential dumping, and access to KeePassXC password manager to extract stored secrets.
These tools enabled attackers to identify valuable targets and escalate privileges within the environment.
Lateral movement and command and control
Once inside, the Toy Ghouls group moved laterally using Remote Desktop Protocol (RDP) for Windows hosts and SSH for Linux servers. For rapid, wide-scale deployment of GenieLocker, they used legitimate system administration utilities PsExec and PAExec. The attackers also established a reverse SSH tunnel, maintaining a persistent command and control (C2) channel to their infrastructure.
Impact on Windows, Linux and ESXi environments
GenieLocker’s dual-platform capability allowed the attackers to strike both traditional and virtualised workloads. On Windows machines, the malware’s PE variant encrypted user and system files, while on Linux and ESXi servers, the ELF variant first stopped running virtual machines before encrypting their virtual disks. This approach maximised disruption, particularly for organisations relying on virtualised services or private clouds.
- Windows build: Written primarily in C, compiled with Microsoft Visual C or C++ libraries. Uses libsodium for cryptographic operations. Requires a secret hex argument to execute and supports command line switches to control behaviour.
- Linux/ESXi build: ELF executable designed to halt VMs before encryption, enhancing impact on virtual environments.
One notable aspect of GenieLocker is the absence of a double-extortion model: Kaspersky found no evidence of data exfiltration, and Toy Ghouls do not maintain a leak site. The attackers focus purely on encryption for ransom.
Ransom communication and conflicting reports
Kaspersky’s analysis highlights an unusual behaviour: GenieLocker does not automatically create ransom notes on disk. Instead, the attackers deliver payment instructions manually during the intrusion, potentially via direct system access or network messaging. This contrasts with other ransomware families, which typically leave a ransom note in each encrypted directory. Some open source reporting from March 2026 claims GenieLocker does generate automatic ransom notes, but Kaspersky’s technical findings do not support this. Security teams should treat this area as evolving and prioritise direct malware analysis for detection.
Indicators of compromise and detection resources
Kaspersky’s report details several key indicators of compromise (IoCs) related to GenieLocker activity:
- MD5 hash:
5d62c1349b8981c396c9a23f4f8f053c(Windows GenieLocker sample) - Presence of SoftPerfect Network Scanner and Mimikatz executables on compromised hosts
- Active reverse SSH tunnels to attacker infrastructure
Additional IoCs, YARA detection rules and threat intelligence artefacts are available via community OSINT repositories, though these should be validated before deployment in production environments. For further technical details and updated indicators, refer to Kaspersky’s IoC section and community threat feeds tracking GenieLocker activity.
Why this event matters for organisations
The GenieLocker campaign highlights critical risks for organisations relying on remote partner access and virtualised infrastructure. The attackers’ use of trusted VPN connections, lateral movement via RDP and SSH, and mass deployment with administration tools all mirror common IT operations, making detection challenging. The absence of data-leak extortion means ransomware incidents may go unreported and escalate rapidly to operational disruption, especially for SMBs with less mature monitoring.
What organisations should do now
- Review and restrict third-party VPN access, monitoring for suspicious activity from partner networks.
- Monitor or restrict RDP and SSH lateral movement, especially when paired with deployment tools like PsExec or PAExec.
- Detect and investigate the use of credential dumping tools and unauthorised reverse SSH tunnels.
- Consult Kaspersky’s detailed IoCs and community YARA rules to update detection content.
Originally reported by securelist.com.
