Toy Ghouls Deploy Custom GenieLocker Ransomware Across Windows, Linux, and ESXi
The financially motivated threat group Toy Ghouls has launched a new custom ransomware named GenieLocker, targeting organizations in Russia, with variants for Windows, Linux, and VMware ESXi environments.
The cybercriminal group known as Toy Ghouls, also identified by aliases such as Bearlyfy, Labubu, and Laboo.boo, has evolved its arsenal with the introduction of a new custom ransomware family dubbed GenieLocker. This development marks a significant step for the financially motivated actors, who previously relied on third-party ransomware solutions like RedAlert, LockBit, and Babuk. The deployment of GenieLocker, observed since March 2026, primarily targets organizations within the Russian Federation, with a notable focus on the manufacturing sector.
Initial access into victim networks was reportedly achieved through compromised credentials obtained via an OpenVPN connection, likely exploiting a trusted relationship with an external partner. Once inside, the threat actors employed a familiar playbook of discovery and credential access techniques. Tools such as SoftPerfect Network Scanner were used for network reconnaissance, while Mimikatz was deployed to dump credentials from compromised systems. Evidence also suggests the attackers accessed KeePassXC password manager databases, seeking to extract stored credentials.
Lateral movement across the compromised infrastructure was facilitated using Remote Desktop Protocol (RDP) for Windows machines and Secure Shell (SSH) for Linux servers. The widespread deployment of the GenieLocker ransomware was executed using legitimate administrative tools like PsExec and PAExec. To maintain command and control, the attackers established a reverse SSH tunnel, ensuring a covert communication channel with their infrastructure.
The impact phase of the attacks saw the encryption of files on Windows systems using the Portable Executable (PE) variant of GenieLocker. For Linux and VMware ESXi environments, the attackers utilized the Executable and Linkable Format (ELF) variant. This version was employed to halt active virtual machines and encrypt their associated disks, demonstrating the ransomware's cross-platform capabilities and its threat to virtualized infrastructure.
Forensic analysis of the incidents indicates that, consistent with Toy Ghouls' past behavior, there was no evidence of data exfiltration. The group does not appear to employ a double-extortion model, nor do they maintain a data-leak website, focusing solely on file encryption for ransom demands.
The Windows variant of GenieLocker, written primarily in C but compiled with C++ libraries, incorporates robust ransomware features. These include process termination, service shutdown, anti-debugging mechanisms, and a sophisticated encryption routine leveraging the open-source libsodium library. Notably, GenieLocker does not leave ransom notes on victim systems; instead, attackers manually deliver ransom demands and contact information, potentially as a tactic to evade automated detection.
GenieLocker supports several command-line arguments to customize its behavior, including specifying the percentage of file content to encrypt, enabling recursive directory processing, and setting a log file path. A mandatory 'secret argument,' a hex string, is required for execution, likely serving as an anti-sandbox and anti-unauthorized usage measure. The ransomware also implements multiple anti-debugging checks through a watchdog thread, terminating its process if a debugger is detected.
The ELF variant for Linux and ESXi shares core encryption functionalities with its Windows counterpart but is tailored for its target operating systems. Its ability to disrupt and encrypt virtual machines on ESXi hosts presents a significant threat to organizations relying on VMware for their infrastructure, underscoring the evolving and expanding reach of modern ransomware operations.