GenieLocker Ransomware: Toy Ghouls (Bearlyfy) Cross-Platform Attacks on Windows, Linux, and ESXi — Threadlinqs Intelligence
As of 2026-07-30, GenieLocker Ransomware: Toy Ghouls (Bearlyfy) Cross-Platform Attacks on Windows, Linux, and ESXi is a high-severity ransomware threat attributed to Toy Ghouls (Ukraine), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 50 indicators of compromise.
Threat ID: TL-2026-1773 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: Toy Ghouls · Ukraine · FINANCIAL
The Toy Ghouls group (aka Bearlyfy, Labubi/Labuib, Laboo.boo) has run a ransomware campaign against Russian organizations since January 2025, escalating in March 2026 to a proprietary Windows locker
Toy Ghouls (publicly tracked as Bearlyfy, also as Labubi/Labuib and Laboo.boo) is a pro-Ukrainian-aligned threat actor that has conducted 70+ attacks against Russian organizations since surfacing around January 2025, with reported infrastructure/toolset overlap tracing back to 2022. The group is characterized in different reporting as either a financially motivated extortion crew (Kaspersky/Securelist) or a dual-purpose sabotage-and-extortion hacktivist operation (F6, via The Hacker News and The Record) with reported ties to the pro-Ukrainian clusters Head Mare and PhantomCore. Both framings agree the group does not perform double-extortion: Securelist explicitly found no evidence of data exfiltration in the campaign it analyzed.
The group's toolset evolved in stages: early attacks relied on off-the-shelf or leaked lockers (LockBit 3 Black from the 2022 leaked builder, Babuk, and third-party strains Hello Kitty, Zeppelin, RedAlert, Rhysida). From May 2025 the group adopted a modified PolyVice ransomware (the Vice Society/DEV-0832/Vanilla Tempest custom-branded locker, itself using NTRUEncrypt + ChaCha20-Poly1305) alongside the legitimate remote-monitoring tool MeshAgent. Beginning March 2026, the group deployed a first proprietary Windows-only locker under the GenieLocker name, with an encryption scheme described as inspired by the Venus/Trinity ransomware families.
The variant analyzed by Kaspersky Securelist in July 2026 is a materially rewritten, cross-platform evolution of GenieLocker with dedicated Windows, Linux, and ESXi builds sharing a common encryption core: XChaCha20-Poly1305 (AEAD) for file/metadata content and Curve25519-XSalsa20-Poly1305 for key wrapping, both implemented via the open-source libsodium library, with BLAKE2b-256 digests and Poly1305 authentication tags recorded per-file alongside lock/journal files. The Windows build requires a mandatory hex-encoded 'secret argument' (max 4096 bytes) as its first CLI parameter — absent that argument the sample will not run, defeating automated sandboxes — and additionally implements active anti-debugging: IsDebuggerPresent/CheckRemoteDebuggerPresent checks at launch plus a 500ms-interval watchdog thread and a CRC32 self-integrity check of its own .text section, terminating itself if tampering or a debugger is detected. It maintains hardcoded exclusion lists (folders, system files, extensions, hostnames) to avoid bricking the host OS, and forcibly stops security/backup/database services (Sophos, Veeam, backup agents, 1C, MSSQL, VSS, Exchange) and kills related processes before encrypting, inhibiting recovery via shadow-copy loss.
The Linux/ESXi build (observed as a binary masquerading as the legitimate Proxmox backup filename 'vzdump') drops the sandbox-evasion secret-argument and debugger checks entirely but adds ESXi-specific tradecraft: double-fork daemonization to detach from the controlling terminal, and direct modification of /etc/vmware/welcome (the ESXi console MOTD/welcome banner) — a distinctive defacement artifact. It defaults to encrypting /vmfs/volumes, meaning virtual machine disks are encrypted at the datastore level after VMs are shut down, a high-impact technique against virtualization hosts.
Observed intrusion tradecraft: initial access via a trusted external partner's OpenVPN connection using stolen-but-valid credentials (Securelist) / exploitation of external-facing services and vulnerable applications plus MeshAgent for remote access (F6 reporting); internal discovery with SoftPerfect Network Scanner; credential access via Mimikatz and an attempted (unconfirmed success) extraction of a KeePassXC password database; lateral movement over RDP (Windows) and SSH (Linux), with PsExec and PAExec used to push the encryptor to many hosts at scale; and a reverse SSH tunnel (with a socks5.exe proxy utility observed) back to a command-and-control server at 89.125.66.101 for operator access. Ransom demands are not delivered via an automatically generated
Target sectors: manufacturing, construction, financial services, retail, technology
Target regions: Russian Federation
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 50 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1587, T1588, T1199, T1078, T1190, T1059, T1622, T1497, T1685, T1036
