GenieLocker is a new ransomware family active since March 2026, targeting organizations in the Russian Federation, primarily in manufacturing. Attributed to the financially motivated Toy Ghouls group (also known as Bearlyfy, Labubu, and Laboo.boo), this custom-designed ransomware marks a shift from their previous reliance on third-party encryption tools like RedAlert, LockBit, and Babuk. GenieLocker exists in two variants: PE builds for Windows and ELF builds for Linux and ESXi. The Windows version features sophisticated capabilities including process termination, service shutdown, anti-debugging techniques, and advanced encryption using the libsodium library with XChaCha20-Poly1305 algorithm. Initial access typically occurs through compromised VPN credentials from trusted partners, followed by deployment of tools like Mimikatz, SoftPerfect Network Scanner, and SSH utilities for lateral movement before deploying ransomware using PsExec and PAExec.

Indicators of Compromise

• hash: 18f61c6d686cffd131c9fd3f3437064b
• hash: 25480dad40152ef3d0c6d38eecc9bd9b
• hash: 34a7f28e0bb69b0d49bacc88bdf20ac1
• hash: 34b8828635f88078735799a3c1ac8e28
• hash: 3a4479b51890373bfc4a011ef41fe376
• hash: 58c0dda52b8f069660166d61fd74f911
• hash: 5d62c1349b8981c396c9a23f4f8f053c
• hash: 780c8f4c6f077da4da96582987920362
• hash: 7dad78584795aa5c160520cc6accf260
• hash: 824ca1e906cc073ee5b0f3519df69a8f
• hash: 9201e35e2993612612919a3c71302cab
• hash: 9969a8221312dba70dd5cbddf83a146c
• hash: 9cd514ff2809ce0b993e3b8649e82a94
• hash: a50eaaf514f4f84e61ca2455a8789753
• hash: a8842616c9057d5cf6e1fe1fa8c3c160
• hash: b893eafed0659f70d4ac250f09073723
• hash: c68b6862725777651085650db34947fc
• hash: d3e06eb34d8eee7ef92cac3ad0a20ff5
• hash: d661cf666b9acbab7cfeae1127a261a9
• hash: d87d0b01d95acc936b7dc47b8f41937a
• hash: de3cfbb50f66079bfee20a6f64e59433
• hash: f08f476f26b01d142ca73923de65fc0c
• hash: f7b9e36e94163a9a303160945f99267a
• hash: fd46a80c2f45577263328984edf7f4dc
• ip: 89.125.66.101