Kaspersky: New GenieLocker Ransomware Encrypts Windows, Linux and VMware ESXi Systems

GenieLocker: Toy Ghouls’ Custom Ransomware Targets Russian Industries

The Toy Ghouls cybercriminal group (also tracked as Bearlyfy or Labubu) has deployed GenieLocker, a custom ransomware strain designed to encrypt Windows, Linux, and VMware ESXi systems. Active since 2025, the group has primarily targeted Russian organizations in the manufacturing, construction, telecommunications, financial, and retail sectors, with a notable campaign in March 2026 documented by Kaspersky.

Attack Methodology

Toy Ghouls gained initial access via an OpenVPN connection from a trusted external partner, exploiting stolen credentials rather than a VPN vulnerability. Once inside, they deployed tools like OpenSSH, SoftPerfect Network Scanner, SOCKS5 proxies, and Mimikatz to harvest passwords, including attempts to breach KeePassXC vaults.

For lateral movement, the group used RDP (Windows) and SSH (Linux), alongside PsExec/PAExec for widespread ransomware deployment. A reverse SSH tunnel facilitated command-and-control (C2) communication, with the primary C2 server identified at 89.125.66.101.

GenieLocker’s Technical Features

The ransomware employs XChaCha20-Poly1305 AEAD encryption, securing files with Curve25519-XSalsa20-Poly1305 for key protection. Key characteristics include:

• Windows Variant (MD5: 5d62c1349b8981c396c9a23f4f8f053c)

  • Written in C/C++ with libsodium for cryptography.
  • Requires a SHA-256-validated "secret" argument to execute, preventing sandbox analysis.
  • Implements anti-debugging checks (e.g., IsDebuggerPresent) and a watchdog thread to detect tampering.
  • Excludes critical OS directories (e.g., Windows, Program Files) to avoid system disruption.
  • Terminates database, backup, virtualization, and browser processes to maximize encryption impact.

• Linux/ESXi Variant (MD5: 9201e35e2993612612919a3c71302cab)

  • Simpler than the Windows version but includes ESXi-specific features (e.g., daemonization, /etc/vmware/welcome modification).
  • Targets /vmfs/volumes by default, prioritizing virtualized environments.

Encryption & Extortion Approach

GenieLocker encrypts files in large chunks (16MB on Windows, 4MB on Linux/ESXi), appending a hardcoded extension (e.g., .03ffc1c4a3da0f02). Unlike many ransomware families, it does not generate automated ransom notes Toy Ghouls deliver demands manually during or after the attack, likely to evade behavioral detection.

Geographic & Sector Focus

Telemetry confirms Russia as the primary target, with no evidence of a double-extortion model or a dedicated leak site. The group’s shift from third-party ransomware (e.g., LockBit, Babuk) to GenieLocker suggests a strategic move toward a unified, cross-platform encryption framework.

Kaspersky detects the threat under verdicts such as Trojan-Ransom.Win64.Agent.genie and Trojan-Ransom.Linux.Agent.genie, with additional indicators available via its Threat Intelligence Reporting service.

Source: https://gbhackers.com/new-genielocker-ransomware-encrypts-windows-linux-and-vmware-esxi-systems/

Kaspersky cybersecurity rating report: https://www.rankiteo.com/company/kaspersky

"id": "KAS1785414553",
"linkid": "kaspersky",
"type": "Cyber Attack",
"date": "3/2026",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"

{'affected_entities': [{'industry': ['Manufacturing',
                                     'Construction',
                                     'Telecommunications',
                                     'Financial',
                                     'Retail'],
                        'location': 'Russia',
                        'type': 'Organization'}],
 'attack_vector': 'Stolen credentials (OpenVPN connection from trusted '
                  'external partner)',
 'data_breach': {'data_encryption': 'XChaCha20-Poly1305 AEAD '
                                    '(Curve25519-XSalsa20-Poly1305 for key '
                                    'protection)'},
 'date_detected': '2025',
 'date_publicly_disclosed': '2026-03',
 'description': 'The Toy Ghouls cybercriminal group (also tracked as Bearlyfy '
                'or Labubu) has deployed GenieLocker, a custom ransomware '
                'strain designed to encrypt Windows, Linux, and VMware ESXi '
                'systems. The group has primarily targeted Russian '
                'organizations in the manufacturing, construction, '
                'telecommunications, financial, and retail sectors since 2025, '
                'with a notable campaign in March 2026 documented by '
                'Kaspersky.',
 'impact': {'systems_affected': 'Windows, Linux, VMware ESXi'},
 'initial_access_broker': {'entry_point': 'OpenVPN connection from trusted '
                                          'external partner'},
 'post_incident_analysis': {'root_causes': 'Stolen credentials, lack of '
                                           'multi-factor authentication (MFA) '
                                           'for OpenVPN, insufficient lateral '
                                           'movement detection'},
 'ransomware': {'data_encryption': True, 'ransomware_strain': 'GenieLocker'},
 'references': [{'source': 'Kaspersky'}],
 'response': {'third_party_assistance': 'Kaspersky'},
 'threat_actor': 'Toy Ghouls (Bearlyfy, Labubu)',
 'title': 'GenieLocker: Toy Ghouls’ Custom Ransomware Targets Russian '
          'Industries',
 'type': 'Ransomware'}