A new ransomware variant named GenieLocker has emerged, targeting Windows, Linux, and VMware ESXi systems. This malware is attributed to the financially motivated group known as Toy Ghouls, also referred to as Bearlyfy, Labubu, and Laboo.boo. Since March 2026, GenieLocker has primarily affected Russia’s manufacturing sector.
Historically, Toy Ghouls utilized ransomware families such as LockBit, Babuk, and RedAlert. The shift to deploying GenieLocker indicates the group’s move towards developing proprietary tools, reducing reliance on third-party malware, and gaining greater control over their operations.
Initial Access and Lateral Movement
In a notable incident from late March, attackers gained initial access through an OpenVPN connection associated with an external partner network. They likely exploited stolen yet valid credentials, leveraging the trusted relationship between the victim and its partner. Once inside, the attackers deployed tools including OpenSSH, socks5.exe, SoftPerfect Network Scanner, and Mimikatz. SoftPerfect was used for system mapping, while Mimikatz facilitated credential dumping.
Further investigation revealed that the attackers accessed installed KeePassXC password managers, suggesting an attempt to retrieve stored credentials. Lateral movement within Windows environments was achieved using Remote Desktop Protocol (RDP), and SSH was utilized to access Linux hosts.
Deployment and Functionality
To distribute the ransomware across compromised systems, the group employed PsExec and PAExec. A reverse SSH tunnel was also established, providing a channel to their command-and-control infrastructure. On Windows systems, GenieLocker is a Portable Executable (PE) ransomware program primarily written in C and compiled with Microsoft Visual C++ libraries. It incorporates anti-debugging checks using IsDebuggerPresent and CheckRemoteDebuggerPresent, along with a watchdog thread that monitors the integrity of its own code section. If any analysis or modification is detected, the malware terminates itself.
The Windows variant requires a specific “secret argument,” a hexadecimal value that must pass a hardcoded SHA-256 validation check before encryption proceeds. This feature likely prevents accidental execution and reduces exposure in sandbox environments. Before encrypting files, GenieLocker terminates processes and services related to databases, backups, security tools, Microsoft Office applications, virtual machines, and email clients. It searches local and network drives while avoiding critical Windows folders and executable file types that could render a host unusable.
GenieLocker utilizes the libsodium cryptographic library with XChaCha20-Poly1305 for file encryption. Per-file keys are protected using Curve25519-XSalsa20-Poly1305 and an embedded attacker-controlled public key. Notably, the ransomware can encrypt only a selected percentage of a file, yet it still encrypts the first chunk even when a zero-percent setting is specified.
The Linux and ESXi ELF variants are simpler than their Windows counterparts, lacking both the secret argument and anti-debugging features. However, they include options focused on ESXi, such as daemonization, worker-thread configuration, delayed execution, and a default target path of /vmfs/volumes. These variants can stop virtual machines and encrypt their virtual disks, posing a significant operational risk for virtualized infrastructure.
Unlike many modern ransomware groups, Toy Ghouls has not been observed using double extortion tactics or operating a public leak site. To mitigate the risk posed by GenieLocker, organizations should review VPN access, revoke outdated partner credentials, monitor the use of tools like PsExec, PAExec, Mimikatz, and reverse SSH tunnels, and ensure that offline backups are protected from both Windows and ESXi compromises.
The emergence of GenieLocker underscores the evolving tactics of ransomware groups, highlighting their shift towards developing proprietary tools to enhance control and effectiveness. This development serves as a reminder for organizations to continuously adapt their cybersecurity strategies to counter increasingly sophisticated threats.
