# GenieLocker Ransomware: Toy Ghouls (Bearlyfy) Cross-Platform Attacks on Windows, Linux, and ESXi

> The Toy Ghouls group (aka Bearlyfy, Labubi/Labuib, Laboo.boo) has run a ransomware campaign against Russian organizations since January 2025, escalating in March 2026 to a proprietary Windows locker (GenieLocker) and, by July 2026, to a rewritten cross-platform Windows/Linux/ESXi variant using XChaCha20-Poly1305 and Curve25519-XSalsa20-Poly1305 (libsodium) with no on-disk ransom notes.

- **Published:** 2026-07-30T00:00:00Z
- **Last reviewed:** 2026-07-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1773
- **ID:** TL-2026-1773
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Toy Ghouls (Ukraine)
- **Detections:** 9 · **IOCs:** 50 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Toy Ghouls (publicly tracked as Bearlyfy, also as Labubi/Labuib and Laboo.boo) is a pro-Ukrainian-aligned threat actor that has conducted 70+ attacks against Russian organizations since surfacing around January 2025, with reported infrastructure/toolset overlap tracing back to 2022. The group is characterized in different reporting as either a financially motivated extortion crew (Kaspersky/Securelist) or a dual-purpose sabotage-and-extortion hacktivist operation (F6, via The Hacker News and The Record) with reported ties to the pro-Ukrainian clusters Head Mare and PhantomCore. Both framings agree the group does not perform double-extortion: Securelist explicitly found no evidence of data exfiltration in the campaign it analyzed.

The group's toolset evolved in stages: early attacks relied on off-the-shelf or leaked lockers (LockBit 3 Black from the 2022 leaked builder, Babuk, and third-party strains Hello Kitty, Zeppelin, RedAlert, Rhysida). From May 2025 the group adopted a modified PolyVice ransomware (the Vice Society/DEV-0832/Vanilla Tempest custom-branded locker, itself using NTRUEncrypt + ChaCha20-Poly1305) alongside the legitimate remote-monitoring tool MeshAgent. Beginning March 2026, the group deployed a first proprietary Windows-only locker under the GenieLocker name, with an encryption scheme described as inspired by the Venus/Trinity ransomware families.

The variant analyzed by Kaspersky Securelist in July 2026 is a materially rewritten, cross-platform evolution of GenieLocker with dedicated Windows, Linux, and ESXi builds sharing a common encryption core: XChaCha20-Poly1305 (AEAD) for file/metadata content and Curve25519-XSalsa20-Poly1305 for key wrapping, both implemented via the open-source libsodium library, with BLAKE2b-256 digests and Poly1305 authentication tags recorded per-file alongside lock/journal files. The Windows build requires a mandatory hex-encoded 'secret argument' (max 4096 bytes) as its first CLI parameter — absent that argument the sample will not run, defeating automated sandboxes — and additionally implements active anti-debugging: IsDebuggerPresent/CheckRemoteDebuggerPresent checks at launch plus a 500ms-interval watchdog thread and a CRC32 self-integrity check of its own .text section, terminating itself if tampering or a debugger is detected. It maintains hardcoded exclusion lists (folders, system files, extensions, hostnames) to avoid bricking the host OS, and forcibly stops security/backup/database services (Sophos, Veeam, backup agents, 1C, MSSQL, VSS, Exchange) and kills related processes before encrypting, inhibiting recovery via shadow-copy loss.

The Linux/ESXi build (observed as a binary masquerading as the legitimate Proxmox backup filename 'vzdump') drops the sandbox-evasion secret-argument and debugger checks entirely but adds ESXi-specific tradecraft: double-fork daemonization to detach from the controlling terminal, and direct modification of /etc/vmware/welcome (the ESXi console MOTD/welcome banner) — a distinctive defacement artifact. It defaults to encrypting /vmfs/volumes, meaning virtual machine disks are encrypted at the datastore level after VMs are shut down, a high-impact technique against virtualization hosts.

Observed intrusion tradecraft: initial access via a trusted external partner's OpenVPN connection using stolen-but-valid credentials (Securelist) / exploitation of external-facing services and vulnerable applications plus MeshAgent for remote access (F6 reporting); internal discovery with SoftPerfect Network Scanner; credential access via Mimikatz and an attempted (unconfirmed success) extraction of a KeePassXC password database; lateral movement over RDP (Windows) and SSH (Linux), with PsExec and PAExec used to push the encryptor to many hosts at scale; and a reverse SSH tunnel (with a socks5.exe proxy utility observed) back to a command-and-control server at 89.125.66.101 for operator access. Ransom demands are not delivered via an automatically generated on-disk note in the variant Securelist analyzed — attackers contact victims manually — though earlier reporting on the group's initial GenieLocker rollout described notes ranging from short instructions to victim-mocking messages, with demands escalating from roughly EUR 80,000 to hundreds of thousands of dollars and a reported ~20% victim payment rate.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1564 Hide Artifacts
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1018 Remote System Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1072 Software Deployment Tools
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1529 System Shutdown/Reboot

## Sources

- [GenieLocker ransomware for Windows, Linux, and ESXi](https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/)
- [Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware](https://thehackernews.com/2026/03/bearlyfy-hits-70-russian-firms-with.html)
- [Pro-Ukraine hacker group Bearlyfy targets Russian companies with custom ransomware](https://therecord.media/ransomware-ukraine-russia-bearlyfy)
- [Ransomware Spotlight: Bearlyfy Hits Russian Firms with Custom GenieLocker Ransomware](https://community.opentextcybersecurity.com/ransomware-spotlight-226/bearlyfy-hits-russian-firms-with-custom-genielocker-ransomware-363894)
- [Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware](https://blog.netmanageit.com/bearlyfy-hits-70-russian-firms-with-custom-genielocker-ransomware/)
- [Bearlyfy/GenieLocker DFIR sample repository](https://github.com/f6-dfir/Ransomware/tree/main/Bearlyfy/GenieLocker)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1773