Toy Ghouls’ new toy: the GenieLocker ransomware

1. Executive summary

GenieLocker is a custom-built ransomware family active since March 2026, deployed by the financially motivated extortion group "Toy Ghouls" (also known as Bearlyfy, Labubu, and Laboo.boo — attribution is unconfirmed; none of these actor names have a MITRE ATT&CK profile). The malware has native PE builds for Windows and ELF builds for Linux/ESXi, using XChaCha20-Poly1305 and Curve25519-XSalsa20-Poly1305 encryption via the libsodium library. KSN telemetry shows detections are overwhelmingly concentrated in the Russian Federation, with the financial services sector among those impacted alongside manufacturing, construction, retail, and technology. No double-extortion model is employed; forensic analysis found no evidence of data exfiltration. EMEA financial services clients with operations, supply chains, or partner relationships extending into the Russian Federation should assess exposure to this threat.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: The Toy Ghouls group (aliases Bearlyfy, Labubu, Laboo.boo) has no MITRE ATT&CK profile in the verified reference data. Attribution is based on open-source intelligence cited by Kaspersky and should be treated as unconfirmed. The following analysis is single-sourced to Kaspersky's Securelist report; verify before enforcement.

Attack chain (March 2026 incident)

1. Initial access: Attackers entered through an OpenVPN connection originating from an external partner's network, using stolen but still valid credentials to exploit the trusted relationship.
2. Tool deployment: On compromised hosts, attackers installed OpenSSH, socks5.exe, SoftPerfect Network Scanner, and Mimikatz.
3. Discovery: SoftPerfect Network Scanner used for network discovery. Mimikatz used to dump credentials. KeePassXC password manager accessed on compromised machines to extract stored credentials from KeePass databases.
4. Lateral movement: RDP used to reach Windows machines; SSH used for Linux servers. Widespread ransomware deployment conducted via legitimate utilities PsExec and PAExec.
5. Command and control: Reverse SSH tunnel established for C2 communication.
6. Impact — Windows: PE version of GenieLocker deployed to encrypt files on Windows machines.
7. Impact — Linux/ESXi: ELF version deployed; active virtual machines stopped and their disks encrypted. Default encryption target path: /vmfs/volumes.

No evidence of data exfiltration was found. Toy Ghouls do not employ a double-extortion model and do not operate a data-leak website.

Windows variant (MD5: 5d62c1349b8981c396c9a23f4f8f053c)

• Language/build: Written in C, compiled with C++ libraries using Microsoft Visual C/C++.
• Crypto library: libsodium.
• Anti-analysis: Requires a "secret argument" (hex string, max 4096 bytes) as the first command-line argument. The hex value is converted to bytes and SHA-256 hashed; the result is compared to a hardcoded value. If matched, the literal string session is appended and the whole string hashed with BLAKE2b-256 (result unused — possibly a feature in development). This likely serves as a sandbox/analysis evasion mechanism and prevents unauthorised use by other actors.
• Anti-debugging: Initial environment check uses IsDebuggerPresent and CheckRemoteDebuggerPresent. A parallel "watchdog" thread runs in an infinite loop every 500ms performing debugger detection checks; if any check fails, the process terminates immediately. The watchdog calculates CRC32 of its own .text section at thread start, saves the hash, and recalculates it every loop iteration — detecting code modification.
• Ransom note behaviour: No ransom notes saved on victim systems. No attacker contact info or negotiation addresses embedded. Ransom demands delivered manually during the attack.
• Command-line arguments:

• Folder exclusions (not encrypted): $recycle.bin, config.msi, $windows.~bt, $windows.~ws, windows, boot, program files, program files (x86), programdata, system volume information, tor browser, windows.old, intel, msocache, perflogs, x64dbg, public, all users, default, microsoft, appdata
• File exclusions (not encrypted): autorun.inf, boot.ini, bootfont.bin, bootsect.bak, desktop.ini, iconcache.db, ntldr, ntuser.dat, ntuser.dat.log, ntuser.ini, thumbs.db, GDIPFONTCACHEV1.DAT, d3d9caps.dat
• Extension exclusions: 386, adv, ani, bat, bin, cab, cmd, com, cpl, cur, deskthemepack, diagcab, diagcfg, diagpkg, dll, drv, exe, hlp, icl, icns, ico, ics, idx, ldf, lnk, mod, mpa, msc, msp, msstyles, msu, nls, nomedia, ocx, prf, ps1, rom, rtp, scr, shs, spl, sys, theme, themepack, wpx, lock, key, hta, msi, pdb, search-ms, MD
• Hostname exclusions: Retrieved via GetComputerNameA; list is empty in the analysed sample.
• Process termination (via TerminateProcess): sql, oracle, ocssd, dbsnmp, synctime, agntsvc, isqlplussvc, xfssvccon, mydesktopservice, ocautoupds, encsvc, firefox, tbirdconfig, mydesktopqos, ocomm, dbeng50, sqbcoreservice, excel, infopath, msaccess, mspub, onenote, outlook, powerpnt, steam, thebat, thunderbird, visio, winword, wordpad, notepad, calc, wuauclt, onedrive, 1c, vmwp, vmms, vmcompute, mssqlserver
• Service termination (via ControlService with SERVICE_CONTROL_STOP): vss, sql, svc$, memtas, mepocs, msexchange, sophos, veeam, backup, GxVss, GxBlr, GxFWD, GxCVD, GxCIMgr, 1c, Mssqlserver, vmwp, vmms, vmcompute, mssqlserver, agent_ovpnconnect
• Encryption details:
• Encrypted file extension (hardcoded): .03ffc1c4a3da0f02
• Auxiliary files per encrypted file: <filename.fileext>.03ffc1c4a3da0f02.lock (contains PID from GetCurrentProcessId) and <fileext>.03ffc1c4a3da0f02.journal (contains hardcoded string VCJOURN, version value 1, unused zeroed fields, total blocks, encrypted block count, CRC32 integrity hash)
• Default chunk size: 0x1000000 bytes (16 MB)
• If -p is specified, calculates number of chunks needed for the specified percentage; each chunk at a random position. First chunk at file beginning is always encrypted regardless of percentage setting.
• File content encrypted with XChaCha20-Poly1305 (unique key and nonce per file). Metadata encrypted with same cipher and key, different nonce. File key encrypted using Curve25519-XSalsa20-Poly1305 with hardcoded attacker master public key.
• Searches all available drives including network shares.
• Encrypted file metadata footer structure:

Linux/ESXi variant (MD5: 9201e35e2993612612919a3c71302cab)

• Version: v1
• Simpler than Windows variant: No secret argument, no anti-debugging, no exclusion lists.
• ESXi-specific features: Double-fork support for daemonising (-d flag); modifies /etc/vmware/welcome (Welcome Message / MOTD) — message left empty in analysed sample. On Linux distributions, MOTD is not modified (different paths).
• Default encryption directory: /vmfs/volumes (ESXi-focused but executable on Linux).
• Command-line arguments:

• Encryption scheme: Identical to Windows — XChaCha20-Poly1305 for content/metadata, Curve25519-XSalsa20-Poly1305 for key encryption. Chunk size 0x400000 (4 MB).
• Command-line help output styling mirrors LockBit's format.

Kaspersky detection names

• Trojan-Ransom.Win64.Agent.genie
• HEUR:TrojanRansom.Win64.Generic
• Trojan-Ransom.Linux.Agent.genie

4. Mitigation & containment

P1 — within 24 hours

• Block known samples: Add all MD5 hashes from §5 to EDR/AV blocklists. Kaspersky detections: Trojan-Ransom.Win64.Agent.genie, HEUR:TrojanRansom.Win64.Generic, Trojan-Ransom.Linux.Agent.genie.
• Hunt for GenieLocker artefacts: Search for files with extension .03ffc1c4a3da0f02, .03ffc1c4a3da0f02.lock, and .03ffc1c4a3da0f02.journal across all endpoints and file shares. Search for the journal marker string VCJOURN in files.
• Audit OpenVPN partner connections: Review all active OpenVPN sessions originating from external partner networks. Verify credential validity, enforce MFA where possible, and rotate any credentials suspected of compromise.
• Restrict PsExec and PAExec: If not required for legitimate operations, block PsExec.exe and PAExec.exe execution via application control / EDR. If required, restrict to specific administrative accounts and monitor for anomalous usage patterns.
• ESXi hardening: Restrict SSH access to ESXi hosts. Monitor for modifications to /etc/vmware/welcome. Alert on processes accessing /vmfs/volumes with write access from non-standard contexts.

P2 — within 72 hours

• Detect anti-debugging/watchdog behaviour: Configure EDR to alert on processes calling IsDebuggerPresent and CheckRemoteDebuggerPresent in combination with TerminateProcess calls — characteristic of GenieLocker's watchdog thread.
• Monitor service termination attempts: Alert on attempts to stop services: vss, msexchange, sophos, veeam, backup, GxVss, GxBlr, GxFWD, GxCVD, GxCIMgr, vmwp, vmms, vmcompute, mssqlserver, agent_ovpnconnect — especially when multiple services are stopped in rapid succession.
• Monitor process termination patterns: Alert on bulk termination of database and office application processes (sql, oracle, mssqlserver, excel, outlook, etc.) from a single process.
• Hunt for lateral movement tools: Search for presence of socks5.exe, OpenSSH installations not deployed by IT, and unexpected Mimikatz execution. Review KeePassXC database access logs for anomalous access patterns.
• Detect reverse SSH tunnels: Monitor outbound SSH connections from internal hosts to unknown external IPs; configure firewall rules to block unauthorised outbound SSH.
• Network share monitoring: GenieLocker encrypts network shares — audit share permissions and monitor for mass file modification events on network-attached storage.

P3 — within 7 days

• Partner VPN review: Conduct a full audit of all external partner VPN connections, credential rotation schedules, and session monitoring controls. Implement time-boxed access and session recording where feasible.
• Backup verification: Verify that backup systems (Veeam, etc. — explicitly targeted by GenieLocker service termination) are isolated from the production network and that recent backups are restorable. Confirm backup service accounts are not domain-joined with credentials dumpable via Mimikatz.
• EDR rule tuning: Create custom detection rules based on the YARA and Sigma rules in §6.

5. Indicators of compromise

md5  A50EAAF514F4F84E61CA2455A8789753
md5  F08F476F26B01D142CA73923DE65FC0C
md5  FD46A80C2F45577263328984EDF7F4DC
md5  DE3CFBB50F66079BFEE20A6F64E59433
md5  780C8F4C6F077DA4DA96582987920362
md5  D87D0B01D95ACC936B7DC47B8F41937A
md5  34A7F28E0BB69B0D49BACC88BDF20AC1
md5  5D62C1349B8981C396C9A23F4F8F053C
md5  A8842616C9057D5CF6E1FE1FA8C3C160
md5  34B8828635F88078735799A3C1AC8E28
md5  D3E06EB34D8EEE7EF92CAC3AD0A20FF5
md5  C68B6862725777651085650DB34947FC
md5  9CD514FF2809CE0B993E3B8649E82A94
md5  824CA1E906CC073EE5B0F3519DF69A8F
md5  25480DAD40152EF3D0C6D38EECC9BD9B
md5  7DAD78584795AA5C160520CC6ACCF260
md5  18F61C6D686CFFD131C9FD3F3437064B
md5  9969A8221312DBA70DD5CBDDF83A146C
md5  F7B9E36E94163A9A303160945F99267A
md5  B893EAFED0659F70D4AC250F09073723
md5  D661CF666B9ACBAB7CFEAE1127A261A9
md5  3A4479B51890373BFC4A011EF41FE376
md5  58C0DDA52B8F069660166D61FD74F911
md5  9201E35E2993612612919A3C71302CAB
filename  kftd.exe
filename  genie_encrypt.exe
filename  run.exe
filename  run2.exe
filename  genie.exe
filename  consultant.exe
filename  tempo.exe
filename  kernel.exe
filename  vzdump
filename  socks5.exe
file_extension  .03ffc1c4a3da0f02
file_extension  .03ffc1c4a3da0f02.lock
file_extension  .03ffc1c4a3da0f02.journal
file_path  /etc/vmware/welcome
file_path  /vmfs/volumes

6. Detection

rule GenieLocker_Windows_Ransomware {
    meta:
        author = "Adverse Trace"
        date = "2026-07-30"
        reference = "https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"
        description = "Detects GenieLocker Windows ransomware based on hardcoded strings and artefacts"
    strings:
        $journal_marker = "VCJOURN" ascii
        $ext1 = ".03ffc1c4a3da0f02.lock" ascii
        $ext2 = ".03ffc1c4a3da0f02.journal" ascii
        $ext3 = ".03ffc1c4a3da0f02" ascii
        $secret_str = "session" ascii
        $help1 = "--percent" ascii
        $help2 = "--recursive" ascii
        $help3 = "--log" ascii
        $help4 = "--help" ascii
        $excl_folder1 = "$recycle.bin" ascii
        $excl_folder2 = "config.msi" ascii
        $excl_folder3 = "$windows.~bt" ascii
        $excl_folder4 = "tor browser" ascii
        $excl_folder5 = "x64dbg" ascii
        $excl_file1 = "bootsect.bak" ascii
        $excl_file2 = "GDIPFONTCACHEV1.DAT" ascii
        $excl_file3 = "d3d9caps.dat" ascii
        $excl_ext1 = "deskthemepack" ascii
        $excl_ext2 = "diagcab" ascii
        $excl_ext3 = "search-ms" ascii
        $svc1 = "memtas" ascii
        $svc2 = "mepocs" ascii
        $svc3 = "GxVss" ascii
        $svc4 = "GxBlr" ascii
        $svc5 = "GxFWD" ascii
        $svc6 = "GxCVD" ascii
        $svc7 = "GxCIMgr" ascii
        $svc8 = "agent_ovpnconnect" ascii
        $proc1 = "sqbcoreservice" ascii
        $proc2 = "mydesktopservice" ascii
        $proc3 = "ocautoupds" ascii
        $proc4 = "xfssvccon" ascii
        $proc5 = "isqlplussvc" ascii
    condition:
        $journal_marker or ($ext1 and $ext2) or ($ext3 and $secret_str) or (5 of ($excl_*) and 3 of ($svc*) and 3 of ($proc*))
}

rule GenieLocker_Linux_ESXi_Ransomware {
    meta:
        author = "Adverse Trace"
        date = "2026-07-30"
        reference = "https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"
        description = "Detects GenieLocker Linux/ESXi ransomware based on hardcoded strings and artefacts"
    strings:
        $vmfs_path = "/vmfs/volumes" ascii
        $welcome_path = "/etc/vmware/welcome" ascii
        $journal_marker = "VCJOURN" ascii
        $ext = ".03ffc1c4a3da0f02" ascii
        $help1 = "-p <perc>" ascii
        $help2 = "-j <workers>" ascii
        $help3 = "-w <sec>" ascii
        $help4 = "-d" ascii
        $version = "v1" ascii
    condition:
        ($vmfs_path and $welcome_path) or ($journal_marker and $ext) or (3 of ($help*))
}

title: GenieLocker Ransomware Service Termination Behaviour
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects rapid termination of multiple backup, AV, database, and VM services characteristic of GenieLocker ransomware
author: Adverse Trace
date: 2026/07/30
references:

    - https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/
logsource:
    product: windows
    service: system
detection:
    selection_service_stop:
        EventID: 7036
        param1:

            - VSS
            - SQL
            - memtas
            - mepocs
            - MSExchange
            - Sophos
            - Veeam
            - Backup
            - GxVss
            - GxBlr
            - GxFWD
            - GxCVD
            - GxCIMgr
            - vmwp
            - vmms
            - vmcompute
            - MSSQLSERVER
            - agent_ovpnconnect
    condition: selection_service_stop | count(param1) > 5
    timeframe: 2m
falsepositives:

    - Legitimate administrative maintenance stopping multiple services
    - Backup software maintenance windows
level: critical

title: GenieLocker ESXi Welcome Message Modification
id: 8b4d2f3e-9c5e-4b7f-0d6e-2e3f4a5b6c7d
status: experimental
description: Detects modification of /etc/vmware/welcome file by GenieLocker ESXi variant
author: Adverse Trace
date: 2026/07/30
references:

    - https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/
logsource:
    product: linux
    category: file_event
detection:
    selection:
        file_path: /etc/vmware/welcome
    condition: selection
falsepositives:

    - Legitimate ESXi MOTD configuration changes
level: high

7. Sources

• Kaspersky Securelist, "Toy Ghouls' new toy: the GenieLocker ransomware," https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/, 2026-07-30

8. Adverse Trace position

GenieLocker represents a capability upgrade for the Toy Ghouls group — transitioning from third-party ransomware-as-a-service (RedAlert, LockBit, Babuk) to a bespoke, cross-platform encryptor with a unified cryptographic backbone. The malware is technically competent (libsodium-based AEAD, anti-debugging with CRC32 integrity checks, sandbox evasion via secret argument, no ransom notes to avoid detection) but the attack chain relies on standard TTPs: stolen VPN credentials, Mimikatz, PsExec/PAExec deployment, and reverse SSH tunnels. Attribution to Toy Ghouls/Bearlyfy/Labubu/Laboo.boo is unconfirmed (no MITRE ATT&CK profiles for any alias) and single-sourced to Kaspersky. The geographic concentration in the Russian Federation and absence of data exfiltration/double-extortion reduces but does not eliminate risk for EMEA financial services — partner VPN compromise is a globally relevant initial access vector, and the financial services sector is explicitly listed among impacted industries. We will monitor for GenieLocker samples and TTP evolution, track any expansion beyond Russian Federation targets, and update IOCs as additional samples emerge. Clients with Russian Federation operations or partner connections should treat this as an elevated threat and prioritise the P1 actions in §4.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.