Kaspersky Details GenieLocker Ransomware Attributed to Toy Ghouls
Summary
Kaspersky analyzes GenieLocker, a custom ransomware family attributed to Toy Ghouls and active since March 2026 against Russian organizations. Attackers likely used stolen partner VPN credentials; Windows, Linux and ESXi variants encrypted systems, with no evidence of [
Key points
- The article attributes GenieLocker to Toy Ghouls and reports the custom ransomware active since March 2026.
- Kaspersky telemetry showed detections concentrated in Russia; manufacturing was the primary affected sector, followed by construction, financial services, retail and technology.
- Initial access was through an OpenVPN connection from an external partner network, likely using stolen but valid credentials.
- Attackers used SoftPerfect Network Scanner for discovery and Mimikatz for credential dumping; they also accessed KeePassXC databases, likely to seek stored credentials.
- RDP and SSH were used for lateral movement, while PsExec and PAExec helped deploy the ransomware.
- Separate Windows and Linux/ESXi builds encrypt files and virtual-machine disks using XChaCha20-Poly1305; the malware uses Curve25519-XSalsa20-Poly1305 for key encryption.
- Forensic analysis found no evidence of data exfiltration; the article says Toy Ghouls did not use double extortion or a data-leak site.
Article Details
- Attack Vectors
- Initial access: attackers entered through an OpenVPN connection from an external partner network, likely using stolen but still valid credentials and the trusted partner relationship.
- Credential access: Mimikatz was used to dump credentials. Attackers also accessed KeePassXC on compromised machines, likely attempting to extract stored credentials.
- Discovery and lateral movement: SoftPerfect Network Scanner was used for discovery; attackers used RDP to reach Windows machines and SSH to reach Linux servers. PsExec and PAExec were used to deploy the ransomware, and a reverse SSH tunnel was established for communication with the C2 server.
- Impact: GenieLocker encrypted files on Windows systems and disks on Linux and ESXi servers; active virtual machines were stopped before disk encryption.
- Defensive Notes
- Kaspersky products detect the malware as Trojan-Ransom.Win64.Agent.genie, HEUR:TrojanRansom.Win64.Generic, and Trojan-Ransom.Linux.Agent.genie.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 89[.]125[.]66[.]101 | Listed as the command-and-control server for the attack. |
| MD5 | 18f61c6d686cffd131c9fd3f3437064b | Hash listed among GenieLocker for Windows samples. |
| MD5 | 25480dad40152ef3d0c6d38eecc9bd9b | Hash listed among GenieLocker for Windows samples. |
| MD5 | 34a7f28e0bb69b0d49bacc88bdf20ac1 | Hash listed among GenieLocker for Windows samples. |
| MD5 | 3a4479b51890373bfc4a011ef41fe376 | Hash listed among GenieLocker for Windows samples. |
| MD5 | 58c0dda52b8f069660166d61fd74f911 | Hash listed among GenieLocker for Windows samples. |
| MD5 | 5d62c1349b8981c396c9a23f4f8f053c | MD5 hash identified for the Windows GenieLocker sample. |
| MD5 | 780c8f4c6f077da4da96582987920362 | Hash listed among GenieLocker for Windows samples. |
| MD5 | 7dad78584795aa5c160520cc6accf260 | Hash listed among GenieLocker for Windows samples. |
| MD5 | 824ca1e906cc073ee5b0f3519df69a8f | Hash listed among GenieLocker for Windows samples. |
| MD5 | 9201e35e2993612612919a3c71302cab | MD5 hash identified for the Linux and ESXi GenieLocker sample. |
| MD5 | 9969a8221312dba70dd5cbddf83a146c | Hash listed among GenieLocker for Windows samples. |
| MD5 | 9cd514ff2809ce0b993e3b8649e82a94 | Hash listed among GenieLocker for Windows samples. |
| MD5 | a50eaaf514f4f84e61ca2455a8789753 | Hash listed among GenieLocker for Windows samples. |
| MD5 | b893eafed0659f70d4ac250f09073723 | Hash listed among GenieLocker for Windows samples. |
| MD5 | c68b6862725777651085650db34947fc | Hash listed among GenieLocker for Windows samples. |
| MD5 | d3e06eb34d8eee7ef92cac3ad0a20ff5 | Hash listed among GenieLocker for Windows samples. |
| MD5 | d661cf666b9acbab7cfeae1127a261a9 | Hash listed among GenieLocker for Windows samples. |
| MD5 | d87d0b01d95acc936b7dc47b8f41937a | Hash listed among GenieLocker for Windows samples. |
| MD5 | de3cfbb50f66079bfee20a6f64e59433 | Hash listed among GenieLocker for Windows samples. |
| MD5 | f08f476f26b01d142ca73923de65fc0c | Hash listed among GenieLocker for Windows samples. |
| MD5 | f7b9e36e94163a9a303160945f99267a | Hash listed among GenieLocker for Windows samples. |
| MD5 | fd46a80c2f45577263328984edf7f4dc | Hash listed among GenieLocker for Windows samples. |
| SHA256 | a8842616c9057d5cf6e1fe1fa8c3c16034b8828635f88078735799a3c1ac8e28 | Hash listed among GenieLocker for Windows samples. |
MITRE ATT&CK
T1003 · OS Credential DumpingMimikatz was used to dump credentials.T1021.001 · Remote Desktop ProtocolAttackers used RDP for lateral movement to Windows machines.T1021.004 · SSHAttackers used SSH for lateral movement to Linux servers.T1046 · Network Service DiscoverySoftPerfect Network Scanner was used to discover systems on the compromised network.T1057 · Process DiscoveryGenieLocker checks for processes that may be using files targeted for encryption and terminates listed processes.T1078 · Valid AccountsAttackers likely used stolen but still valid credentials to connect through the partner's OpenVPN access.T1090.001 · Internal ProxyAttackers established a reverse SSH tunnel to communicate with their C2 server.T1105 · Ingress Tool TransferAttackers installed additional tools, including OpenSSH, socks5.exe, SoftPerfect Network Scanner, and Mimikatz, on compromised hosts.T1133 · External Remote ServicesAttackers entered the environment through an OpenVPN connection originating from an external partner network.T1219 · Remote Access ToolsOpenSSH and socks5.exe were installed on compromised hosts as additional remote-access tooling.T1486 · Data Encrypted for ImpactGenieLocker encrypted files on Windows systems and disks on Linux and ESXi servers.T1497.001 · System ChecksThe Windows build checks for debuggers and uses a required secret argument that the article says may help avoid sandbox execution.T1529 · System Shutdown/RebootAttackers stopped active virtual machines before encrypting disks on Linux and ESXi servers.T1562.001 · Disable or Modify ToolsGenieLocker terminates processes and stops services, including listed security and backup-related services, before encryption.T1569.002 · Service ExecutionPsExec and PAExec were used to deploy GenieLocker across systems.
Threat Actors
BearlyfyThe article explicitly identifies Bearlyfy as another name for Toy Ghouls, the group attributed to GenieLocker attacks against Russian organizations.Laboo.booThe article explicitly identifies Laboo.boo as another name for Toy Ghouls, the group attributed to GenieLocker attacks against Russian organizations.LabubuThe article explicitly identifies Labubu as another name for Toy Ghouls, the group attributed to GenieLocker attacks against Russian organizations.Toy GhoulsThe article attributes GenieLocker attacks against Russian organizations to Toy Ghouls, citing open-source intelligence.
Malware
BabukThe Toy Ghouls, also known as Bearlyfy, Labubu and Laboo.boo, is a financially motivated extortion group, which previously relied on third-party encryption Trojans like RedAlert, LockBit, and Babuk.GenieLockerGenieLocker is a custom ransomware family used by Toy Ghouls against Russian organizations, especially in manufacturing, with Windows, Linux, and ESXi variants active since March 2026.LockBitThe Toy Ghouls, also known as Bearlyfy, Labubu and Laboo.boo, is a financially motivated extortion group, which previously relied on third-party encryption Trojans like RedAlert, LockBit, and Babuk.RedAlertThe Toy Ghouls, also known as Bearlyfy, Labubu and Laboo.boo, is a financially motivated extortion group, which previously relied on third-party encryption Trojans like RedAlert, LockBit, and Babuk.
Vendors
Products
ESXiGenieLocker is a custom ransomware family used by Toy Ghouls against Russian organizations, especially in manufacturing, with Windows, Linux, and ESXi variants active since March 2026.KeePassXCForensic analysis also shows that they accessed the KeePassXC password manager already installed on several compromised machines, likely attempting to extract the stored credentials from the KeePass databases.LinuxGenieLocker is a custom ransomware family used by Toy Ghouls against Russian organizations, especially in manufacturing, with Windows, Linux, and ESXi variants active since March 2026.Microsoft WindowsGenieLocker is a custom ransomware family used by Toy Ghouls against Russian organizations, especially in manufacturing, with Windows, Linux, and ESXi variants active since March 2026.OpenVPNThe group used stolen OpenVPN credentials for entry, deployed tools like Mimikatz and PsExec, and encrypted systems without evidence of data theft or double extortion.
Tools
MimikatzThe group used stolen OpenVPN credentials for entry, deployed tools like Mimikatz and PsExec, and encrypted systems without evidence of data theft or double extortion.OpenSSHThe attackers used tools such as OpenSSH, socks5.exe, SoftPerfect Network Scanner, Mimikatz, PsExec, and PAExec for discovery, credential theft, lateral movement, and deployment.PAExecThe attackers used tools such as OpenSSH, socks5.exe, SoftPerfect Network Scanner, Mimikatz, PsExec, and PAExec for discovery, credential theft, lateral movement, and deployment.PsExecThe group used stolen OpenVPN credentials for entry, deployed tools like Mimikatz and PsExec, and encrypted systems without evidence of data theft or double extortion.socks5.exeThe attackers used tools such as OpenSSH, socks5.exe, SoftPerfect Network Scanner, Mimikatz, PsExec, and PAExec for discovery, credential theft, lateral movement, and deployment.SoftPerfect Network ScannerThe attackers used tools such as OpenSSH, socks5.exe, SoftPerfect Network Scanner, Mimikatz, PsExec, and PAExec for discovery, credential theft, lateral movement, and deployment.
Countries
Industries
ConstructionThe main victims were organizations in the Russian Federation, with manufacturing most affected and construction, financial services, retail, and technology also impacted.Financial ServicesThe main victims were organizations in the Russian Federation, with manufacturing most affected and construction, financial services, retail, and technology also impacted.ManufacturingGenieLocker is a custom ransomware family used by Toy Ghouls against Russian organizations, especially in manufacturing, with Windows, Linux, and ESXi variants active since March 2026.RetailThe main victims were organizations in the Russian Federation, with manufacturing most affected and construction, financial services, retail, and technology also impacted.TechnologyThe main victims were organizations in the Russian Federation, with manufacturing most affected and construction, financial services, retail, and technology also impacted.