Researchers Say Bearlyfy Targeted 70+ Russian Companies and Deployed GenieLocker
Summary
F6 researchers say the pro-Ukrainian Bearlyfy group has targeted more than 70 Russian companies since January 2025 and deployed custom Windows ransomware, GenieLocker, since early March.
Key points
- F6 researchers report more than 70 Bearlyfy attacks against Russian companies since January 2025.
- The group’s reported ransom demands have risen from a few thousand dollars to hundreds of thousands.
- F6 estimates that roughly one in five victims pays.
- Since early March, Bearlyfy has deployed custom Windows ransomware called GenieLocker; researchers believe the group developed it.
- Earlier operations used leaked ransomware tools, including LockBit 3 Black and a modified version of Babuk for Linux.
- F6 has observed collaboration between Bearlyfy and other pro-Ukrainian groups, including Head Mare.
Article Details
- Event Type
- Ransomware attacks and extortion targeting Russian companies
- Impact
- Researchers at F6 report that Bearlyfy has carried out more than 70 attacks since January 2025. Ransom demands have risen from a few thousand dollars to hundreds of thousands, and F6 estimates that roughly one in five victims pays. Since early March, the group has deployed custom Windows ransomware called GenieLocker. Earlier attacks used LockBit 3 Black and a modified version of Babuk; F6 also reports collaboration with Head Mare.
Threat Actors
BearlyfyF6 reports that this pro-Ukrainian group has conducted more than 70 ransomware attacks against Russian companies since January 2025, using ransomware for financial extortion and political damage.Head MareF6 reports observing collaboration between Bearlyfy and this pro-Ukrainian group; the article does not specify the nature of the collaboration.
Malware
BabukResearchers say the group has developed and begun deploying its own Windows ransomware, GenieLocker, after previously using leaked tools like LockBit 3 Black and Babuk, and roughly one in five victims pays the ransom.GenieLockerResearchers say the group has developed and begun deploying its own Windows ransomware, GenieLocker, after previously using leaked tools like LockBit 3 Black and Babuk, and roughly one in five victims pays the ransom.LockBit 3 BlackResearchers say the group has developed and begun deploying its own Windows ransomware, GenieLocker, after previously using leaked tools like LockBit 3 Black and Babuk, and roughly one in five victims pays the ransom.