GenieLocker, a newly identified ransomware linked to the financially motivated Toy Ghouls group, targets Windows, Linux, and VMware ESXi systems and has primarily attacked Russia’s manufacturing sector since March 2026.
The Toy Ghouls group, also known as Bearlyfy, Labubu, and Laboo.boo, previously relied on ransomware families such as LockBit, Babuk, and RedAlert.
The transition to GenieLocker reduces the group’s dependence on third-party malware, allowing for greater control over its ransomware operations.
In a late-March intrusion, attackers reportedly gained initial access through an OpenVPN connection from an external partner network. They are believed to have used stolen but valid credentials, exploiting the trusted relationship between the victim and its partner.
Once inside the network, the attackers deployed OpenSSH, socks5.exe, SoftPerfect Network Scanner, and Mimikatz. SoftPerfect was used to map systems, while Mimikatz was employed for credential dumping.
GenieLocker Ransomware Attack
Investigators also found evidence that the operators accessed installed KeePassXC password managers, likely searching for credentials stored in password databases. The group moved laterally through Windows environments using Remote Desktop Protocol and accessed Linux hosts via SSH.
They utilized PsExec and PAExec to distribute the ransomware across compromised systems. At the same time, a reverse SSH tunnel provided a channel to their command-and-control infrastructure. On Windows, GenieLocker is a PE-based ransomware program primarily written in C and compiled with Microsoft Visual C++ libraries.
It features anti-debugging checks using IsDebuggerPresent and CheckRemoteDebuggerPresent, along with a watchdog thread that verifies the integrity of its own code section. If any analysis or modification is detected, the malware terminates itself.
The Windows variant requires a “secret argument,” which is a hexadecimal value that must pass a hardcoded SHA-256 validation check before encryption can proceed. This feature may help prevent accidental execution and reduce exposure in sandbox environments.
Before encrypting files, GenieLocker terminates processes and services related to databases, backups, security tools, Microsoft Office applications, virtual machines, and email clients. It also searches local and network drives while avoiding critical Windows folders and executable file types that could render a host unusable.
Securelist by Kaspersky said in a report shared with Cyber Security News that GenieLocker uses the libsodium cryptographic library with XChaCha20-Poly1305 for file encryption, while per-file keys are protected using Curve25519-XSalsa20-Poly1305 and an embedded attacker-controlled public key.
Notably, the ransomware can encrypt only a selected percentage of a file. Yet, it still encrypts the first chunk even when a zero-percent setting is specified..
The Linux and ESXi ELF variants are simpler than their Windows counterparts, lacking both the secret argument and anti-debugging features.
However, it includes options focused on ESXi, such as daemonization, worker-thread configuration, delayed execution, and a default target path of /vmfs/volumes.
It can stop virtual machines and encrypt their virtual disks, posing a significant operational risk for virtualized infrastructure. Unlike many modern ransomware groups, Toy Ghouls has not been observed using double extortion or operating a public leak site.
Defenders should review VPN access, revoke stale partner credentials, monitor the use of PsExec, PAExec, Mimikatz, and reverse SSH tunnels, and ensure that offline backups are protected from both Windows and ESXi compromises.
