A financially motivated extortion crew called Toy Ghouls has stopped renting other people's ransomware and started shipping its own. Kaspersky researchers Fedor Sinitsyn and Yanis Zinchenko have published a full teardown of GenieLocker, a custom encryptor the group has used against organizations in Russia since March 2026, with separate builds for Windows, Linux and VMware ESXi.
The group, also tracked as Bearlyfy, Labubu and Laboo.boo, previously leaned on third party encryptors including RedAlert, LockBit and Babuk. Building its own tool cuts that dependency and gives the crew one cryptographic design across every platform it attacks.
Who is being hit
Kaspersky telemetry places GenieLocker detections overwhelmingly inside the Russian Federation. Manufacturing was the hardest hit sector in the March 2026 campaign, followed closely by construction, then financial services, retail and technology. The wider picture sits on our Russia country profile.
One detail sets this crew apart from most modern ransomware operations: there is no leak site and no data theft. Forensic work on the March intrusion found no evidence of exfiltration, matching earlier Toy Ghouls incidents. The group does not run double extortion, and GenieLocker does not even drop a ransom note. It carries no contact address or negotiation portal, so the attackers have to deliver their demand by hand during the attack. Kaspersky assesses this is likely a detection dodge, since security tools often flag the sudden creation of hundreds of identical readme files.
How the attack works
In the March incident the attackers came in over an OpenVPN connection originating from an external partner's network, using stolen but still valid credentials. That is trusted relationship abuse: the victim's own supplier became the doorway.
Once inside they installed OpenSSH, a SOCKS5 proxy, SoftPerfect Network Scanner and Mimikatz, dumped credentials, and went after KeePassXC password databases already sitting on compromised machines. Lateral movement used RDP for Windows hosts and SSH for Linux servers, a reverse SSH tunnel carried command and control traffic, and the encryptor was pushed out with the legitimate admin utilities PsExec and PAExec. On the ESXi side, the attackers shut down running virtual machines first, then encrypted their disks.
Inside the encryptor
The Windows build refuses to run without a secret hexadecimal argument whose SHA-256 hash matches a hardcoded value, which keeps it from detonating in sandboxes and stops other criminals from reusing the binary. A watchdog thread then checks for debuggers every 500 milliseconds and recalculates a checksum of its own code section to spot tampering, killing the process if anything looks wrong. Files are encrypted with XChaCha20-Poly1305 using the open source libsodium library, with each file key wrapped under the attackers' Curve25519 public key, and an operator flag controls what percentage of each file gets scrambled for speed. The ESXi variant is simpler but copies LockBit's command line help layout, which reinforces the idea that the developers set out to build a LockBit replacement of their own.
What you should do
Audit every VPN and remote path a partner or supplier holds into your network, and require phishing resistant multi factor authentication on them. Alert on mass PsExec or PAExec execution, on stops of backup and hypervisor services (the encryptor kills vss, veeam, backup and agent_ovpnconnect among others), and on ESXi hosts where virtual machines are powered off out of hours. Keep backups offline, because with no leak site the only lever this crew has is your ability to restore. Our earlier reporting on LockBit's continuing European claims covers the toolkit lineage GenieLocker is replacing.
Indicators
Windows sample MD5 5d62c1349b8981c396c9a23f4f8f053c (genie_encrypt.exe), Linux and ESXi sample MD5 9201e35e2993612612919a3c71302cab (vzdump), command and control at 89[.]125[.]66[.]101. Encrypted files in the analysed sample carried the extension .03ffc1c4a3da0f02 alongside .lock and .journal helper files.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.