Threat reportRansomwareTL-2026-1773
GenieLocker Ransomware: Toy Ghouls (Bearlyfy) Cross-Platform Attacks on Windows, Linux, and ESXi
GenieLocker Ransomware (TL-2026-1773), also tracked as Toy Ghouls, is a high-severity ransomware operation, first published 2026-07-30. It is attributed to Toy Ghouls (Ukraine) with medium confidence, affects Microsoft Windows (Server and Workstation), maps to 26 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 50 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 26MITRE ATT&CK
- Actors
- 1Toy Ghouls
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 50Indicators of compromise
Key facts for TL-2026-1773
- Threat ID
- TL-2026-1773
- Also known as
- Toy Ghouls, GenieLocker
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Toy Ghouls
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Ukraine
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, construction, financial services, retail, technology
- Target regions
- Russian Federation
- Detection rules
- 9
- Indicators of compromise
- 50
Malware and tooling in GenieLocker Ransomware
Malware and tooling: Babuk - S0638, GenieLocker, LockBit 3.0 - S1202, PolyVice, KeePassXC, MeshAgent, Mimikatz, PAExec, PSEXEC, SoftPerfect Network Scanner, socks5.exe
How GenieLocker Ransomware works
The Toy Ghouls group (aka Bearlyfy, Labubi/Labuib, Laboo.boo) has run a ransomware campaign against Russian organizations since January 2025, escalating in March 2026 to a proprietary Windows locker (GenieLocker) and, by July 2026, to a rewritten cross-platform Windows/Linux/ESXi variant using XChaCha20-Poly1305 and Curve25519-XSalsa20-Poly1305 (libsodium) with no on-disk ransom notes.
Toy Ghouls (publicly tracked as Bearlyfy, also as Labubi/Labuib and Laboo.boo) is a pro-Ukrainian-aligned threat actor that has conducted 70+ attacks against Russian organizations since surfacing around January 2025, with reported infrastructure/toolset overlap tracing back to 2022. The group is characterized in different reporting as either a financially motivated extortion crew (Kaspersky/Securelist) or a dual-purpose sabotage-and-extortion hacktivist operation (F6, via The Hacker News and The Record) with reported ties to the pro-Ukrainian clusters Head Mare and PhantomCore. Both framings agree the group does not perform double-extortion: Securelist explicitly found no evidence of data exfiltration in the campaign it analyzed.
The group's toolset evolved in stages: early attacks relied on off-the-shelf or leaked lockers (LockBit 3 Black from the 2022 leaked builder, Babuk, and third-party strains Hello Kitty, Zeppelin, RedAlert, Rhysida). From May 2025 the group adopted a modified PolyVice ransomware (the Vice Society/DEV-0832/Vanilla Tempest custom-branded locker, itself using NTRUEncrypt + ChaCha20-Poly1305) alongside the legitimate remote-monitoring tool MeshAgent. Beginning March 2026, the group deployed a first proprietary Windows-only locker under the GenieLocker name, with an encryption scheme described as inspired by the Venus/Trinity ransomware families.
The variant analyzed by Kaspersky Securelist in July 2026 is a materially rewritten, cross-platform evolution of GenieLocker with dedicated Windows, Linux, and ESXi builds sharing a common encryption core: XChaCha20-Poly1305 (AEAD) for file/metadata content and Curve25519-XSalsa20-Poly1305 for key wrapping, both implemented via the open-source libsodium library, with BLAKE2b-256 digests and Poly1305 authentication tags recorded per-file alongside lock/journal files. The Windows build requires a mandatory hex-encoded 'secret argument' (max 4096 bytes) as its first CLI parameter — absent that argument the sample will not run, defeating automated sandboxes — and additionally implements active anti-debugging: IsDebuggerPresent/CheckRemoteDebuggerPresent checks at launch plus a 500ms-interval watchdog thread and a CRC32 self-integrity check of its own .text section, terminating itself if tampering or a debugger is detected. It maintains hardcoded exclusion lists (folders, system files, extensions, hostnames) to avoid bricking the host OS, and forcibly stops security/backup/database services (Sophos, Veeam, backup agents, 1C, MSSQL, VSS, Exchange) and kills related processes before encrypting, inhibiting recovery via shadow-copy loss.
The Linux/ESXi build (observed as a binary masquerading as the legitimate Proxmox backup filename 'vzdump') drops the sandbox-evasion secret-argument and debugger checks entirely but adds ESXi-specific tradecraft: double-fork daemonization to detach from the controlling terminal, and direct modification of /etc/vmware/welcome (the ESXi console MOTD/welcome banner) — a distinctive defacement artifact. It defaults to encrypting /vmfs/volumes, meaning virtual machine disks are encrypted at the datastore level after VMs are shut down, a high-impact technique against virtualization hosts.
Observed intrusion tradecraft: initial access via a trusted external partner's OpenVPN connection using stolen-but-valid credentials (Securelist) / exploitation of external-facing services and vulnerable applications plus MeshAgent for remote access (F6 reporting); internal discovery with SoftPerfect Network Scanner; credential access via Mimikatz and an attempted (unconfirmed success) extraction of a KeePassXC password database; lateral movement over RDP (Windows) and SSH (Linux), with PsExec and PAExec used to push the encryptor to many hosts at scale; and a reverse SSH tunnel (with a socks5.exe proxy utility observed) back to a command-and-control server at 89.125.66.101 for operator access. Ransom demands are not delivered via an automatically generated on-disk note in the variant Securelist analyzed — attackers contact victims manually — though earlier reporting on the group's initial GenieLocker rollout described notes ranging from short instructions to victim-mocking messages, with demands escalating from roughly EUR 80,000 to hundreds of thousands of dollars and a reported ~20% victim payment rate.
MITRE ATT&CK techniques used in TL-2026-1773
Credential Access
T1003 OS Credential Dumping; T1555 Credentials from Password Stores
Discovery
T1018 Remote System Discovery; T1057 Process Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
Lateral Movement
T1021 Remote Services; T1072 Software Deployment Tools; T1570 Lateral Tool Transfer
Defense Evasion
T1036 Masquerading; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1622 Debugger Evasion
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Command and Control
T1219 Remote Access Tools; T1572 Protocol Tunneling
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
defense-impairment
Affected products and versions in GenieLocker Ransomware
- Microsoft — Windows (Server and Workstation)
Vulnerable versions: All supported versions reachable via compromised partner credentials/RDP - Broadcom (VMware) — VMware ESXi
Vulnerable versions: ESXi hosts reachable via compromised network/SSH access; datastore encryption via /vmfs/volumes - Linux distributions (generic) — Linux servers
Vulnerable versions: Any Linux host reachable via SSH with compromised credentials
Remediation for GenieLocker Ransomware
Patches
- No CVE or vendor patch applies — initial access relies on valid stolen partner credentials and abuse of legitimate remote-access/admin tooling, not a software vulnerability
Immediate actions
- Rotate and enforce phishing-resistant MFA on all third-party/partner VPN and remote-access credentials, especially OpenVPN accounts used by external partners
- Hunt for execution of SoftPerfect Network Scanner, Mimikatz, PsExec/PAExec, MeshAgent, and socks5.exe across endpoints and servers
- Inspect ESXi hosts' /etc/vmware/welcome for unauthorized modification as a compromise indicator, and snapshot/isolate affected hypervisors
- Block the identified C2 IP 89.125.66.101 at the network perimeter and hunt for outbound reverse-SSH-tunnel traffic
- Audit for the specific dropped filenames (kftd.exe, genie_encrypt.exe, run.exe, run2.exe, genie.exe, consultant.exe, tempo.exe, kernel.exe, vzdump) and hardcoded process/service-stop targets (vss, sql, msexchange, sophos, veeam, backup, 1c, mssqlserver, vmcompute)
Workarounds
- Require hardware-token or FIDO2 MFA on all external partner/VPN access as a compensating control for credential theft
- Alert on unexpected double-fork/daemonizing processes and MOTD/welcome-banner file writes on ESXi hosts
Longer-term hardening
- Deploy EDR with behavioral detection tuned for anti-debug/anti-sandbox loader behavior, watchdog-thread patterns, and mass file-encryption activity
- Segment partner/VPN access networks away from internal server and hypervisor management networks (least privilege)
- Harden ESXi management interfaces: disable SSH by default, restrict access to dedicated jump hosts, enable lockdown mode
- Maintain centralized, immutable, off-host backups with tested restoration for both Windows file servers and ESXi/vSAN datastores
- Monitor for access to password-manager database files (e.g., KeePassXC .kdbx) as a credential-theft indicator
Timeline of GenieLocker Ransomware
- The LockBit 3.0 ('Black') ransomware-as-a-service builder is leaked online; the group later repurposes it, alongside Babuk and other third-party strains, for its earliest attacks before developing custom ransomware (year-level approximate date; per The Record).
- Bearlyfy (Kaspersky designation: Toy Ghouls; also Labubi/Labuib, Laboo.boo) surfaces as a pro-Ukrainian-aligned threat actor, initially targeting smaller Russian businesses with limited sophistication and modest few-thousand-dollar ransom demands using leaked/third-party lockers; reported infrastructure overlaps trace to 2022 (approximate/month-level date).
- Group begins using a modified PolyVice ransomware (NTRUEncrypt + ChaCha20-Poly1305, associated with Vice Society/DEV-0832/Vanilla Tempest) rather than purely third-party lockers (approximate date).
- F6 threat intelligence attributes at least 30 confirmed Russian-organization victims to the group by this point (approximate date).
- F6 (Russian security vendor) publishes the first detailed public analysis of the group's operations and toolset (approximate date).
- Group begins deploying a proprietary Windows-only ransomware branded GenieLocker (encryption described as inspired by the Venus/Trinity families) alongside the MeshAgent remote-access tool; ransom demands have by this point escalated to hundreds of thousands of dollars with a reported ~20% victim payment rate (early March 2026, approximate; per F6 reporting).
- The Record publishes reporting (by Daryna Antoniuk) on the pro-Ukraine Bearlyfy group's shift to custom GenieLocker ransomware and its 70+ attacks against Russian companies over the prior year, citing F6 and noting reported (undated) ties to the pro-Ukrainian cluster Head Mare.
- The Hacker News, OpenText Cybersecurity's Ransomware Spotlight, and NetManageIT publish reporting citing F6 that Bearlyfy has hit 70+ Russian firms with the custom GenieLocker ransomware.
- Kaspersky/Securelist's incident-response engagement references a GenieLocker encryption incident at a victim organization in late March 2026, marking an early observed use of the ransomware within the campaign window later confirmed to run through July 2026 (approximate date; per Securelist).
- Kaspersky Securelist discloses a rewritten, cross-platform GenieLocker with dedicated Windows, Linux, and ESXi builds using XChaCha20-Poly1305/Curve25519-XSalsa20-Poly1305 (libsodium), anti-debugging, double-fork daemonization, and ESXi welcome-banner modification, actively targeting Russian manufacturing since March 2026.
Sources cited for GenieLocker Ransomware
- GenieLocker ransomware for Windows, Linux, and ESXi
- Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware
- Pro-Ukraine hacker group Bearlyfy targets Russian companies with custom ransomware
- Ransomware Spotlight: Bearlyfy Hits Russian Firms with Custom GenieLocker Ransomware
- Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware
- Bearlyfy/GenieLocker DFIR sample repository
Detection coverage for TL-2026-1773
As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1773 across Splunk SPL, Microsoft KQL and Sigma, covering 50 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.