Toy Ghouls’ new toy: the GenieLocker ransomware

GenieLocker is a new ransomware family active since March 2026, targeting organizations in the Russian Federation, primarily in manufacturing. Attributed to the financially motivated Toy Ghouls group (also known as Bearlyfy, Labubu, and Laboo.boo), this custom-designed ransomware marks a shift from their previous reliance on third-party encryption tools like RedAlert, LockBit, and Babuk. GenieLocker exists in two variants: PE builds for Windows and ELF builds for Linux and ESXi. The Windows version features sophisticated capabilities including process termination, service shutdown, anti-debugging techniques, and advanced encryption using the libsodium library with XChaCha20-Poly1305 algorithm. Initial access typically occurs through compromised VPN credentials from trusted partners, followed by deployment of tools like Mimikatz, SoftPerfect Network Scanner, and SSH utilities for lateral movement before deploying ransomware using PsExec and PAExec.

• A quiet week in infosec <.<HighVulnerability2026-10-29
• IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor AssessmentNews2026-10-29
• NIK C2: The new AI-enabled command-and-control frameworkMalware2026-10-29
• Unwrapping Retail Peak Season Cyber ThreatsAnalysis2026-10-28
• Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US PrisonMalware2026-10-28