F6 Links Bearlyfy to 70+ Attacks on Russian Firms and New GenieLocker Ransomware
Summary
F6 attributes more than 70 attacks on Russian companies since 2025 to Bearlyfy, which reportedly began using its custom Windows ransomware GenieLocker in March 2026.
Key points
- F6 attributes more than 70 attacks on Russian companies since January 2025 to Bearlyfy, also known as Labubu.
- The group reportedly shifted from LockBit 3 and Babuk encryptors to custom Windows ransomware GenieLocker in March 2026.
- F6 says Bearlyfy gains access by exploiting external services and vulnerable applications, then uses tools such as MeshAgent for remote access and follow-on activity.
- F6 reports overlaps with PhantomCore and says Bearlyfy has collaborated with Head Mare.
- According to F6, about one in five victims pays; ransom demands have reportedly risen to hundreds of thousands of dollars.
Article Details
- Event Type
- Ransomware attacks involving extortion and sabotage against Russian companies.
- Impact
- F6 attributed more than 70 attacks against Russian companies to Bearlyfy since January 2025. The attacks have involved data encryption, destruction, or modification. According to F6, about one in five victims pay, and ransom demands have risen to hundreds of thousands of dollars. Since March 2026, the group has reportedly used its custom Windows ransomware GenieLocker.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe article says Bearlyfy obtains initial access by exploiting external services and vulnerable applications.T1219 · Remote Access ToolsThe article says Bearlyfy deploys MeshAgent to facilitate remote access.T1485 · Data DestructionThe article says Bearlyfy attacks may destroy victim data.T1486 · Data Encrypted for ImpactThe article says Bearlyfy deploys ransomware to encrypt victim data.T1565 · Data ManipulationThe article says Bearlyfy attacks may modify victim data.
Threat Actors
BearlyfyF6 attributed more than 70 attacks against Russian companies to Bearlyfy since January 2025, describing the group’s activity as involving extortion and sabotage.DEV-0832The article identifies DEV-0832 as another name for Vice Society, to which it attributes the PolyVice ransomware family.Head MareThe article says Bearlyfy is reported to have collaborated with Head Mare.PhantomCoreThe article describes PhantomCore as a group assessed to operate with Ukrainian interests in mind and reports attacks against Russian and Belarusian companies since 2022. It also reports overlaps with Bearlyfy.Toy GhoulsThe article identifies Labubu as another name for Bearlyfy, which F6 attributed to attacks against Russian companies.Vanilla TempestThe article identifies Vanilla Tempest as another name for Vice Society, to which it attributes the PolyVice ransomware family.Vice SocietyThe article attributes the PolyVice ransomware family to Vice Society and identifies Vice Society as also known as DEV-0832 and Vanilla Tempest.
Malware
Babukagainst Russian companies since early 2025, evolving from small intrusions using LockBit 3 and Babuk encryptors to highâvalue extortion and sabotage.GenieLockerSince March 2026 the group has deployed a proprietary Windows ransomware called GenieLocker and used modified PolyVice components and tools like MeshAgent, driving larger ransom demands and showing overlaps withLockBit 3 (Black)The group initially used LockBit 3 (Black), Babuk, and thirdâparty lockers delivered via PolyVice and Vice Society infrastructure.PolyViceMarch 2026 the group has deployed a proprietary Windows ransomware called GenieLocker and used modified PolyVice components and tools like MeshAgent, driving larger ransom demands and showing overlaps with PhantomCoreTrinityIn March 2026 Bearlyfy began deploying a proprietary Windows ransomware named GenieLocker, inspired by Venus/Trinity.VenusIn March 2026 Bearlyfy began deploying a proprietary Windows ransomware named GenieLocker, inspired by Venus/Trinity.