GenieLocker expands ransomware threat across major platforms

A custom ransomware family linked to the Toy Ghouls cybercrime group is targeting Windows, Linux and VMware ESXi systems, giving its operators the ability to disrupt entire corporate networks through a single attack campaign.

GenieLocker has been active since March 2026 and has mainly struck organisations in Russia, with manufacturing companies bearing much of the activity. Construction, financial services, retail and technology businesses have also encountered the malware, indicating that its operators may be widening their target profile.

Toy Ghouls, also tracked under the names Bearlyfy, Labubu and Laboo. boo, previously deployed ransomware developed by other groups. Its arsenal included LockBit, Babuk, RedAlert and other externally sourced encryptors. GenieLocker marks a shift towards proprietary malware that can be modified and deployed without depending on third-party ransomware providers.

The development gives the group greater control over encryption, attack timing and compatibility across different operating systems. Windows versions are distributed as Portable Executable files, while Linux and ESXi variants use the Executable and Linkable Format common to Unix-based environments.

The cross-platform design is particularly significant for manufacturers and other organisations that rely on virtualised infrastructure. ESXi servers often host multiple virtual machines carrying business applications, databases and operational workloads. Encrypting the underlying virtual disks can disable several critical systems simultaneously.

During an intrusion investigated in late March, the attackers entered the victim’s network through an OpenVPN connection originating from an external partner. Stolen but valid credentials were apparently used, allowing the operators to exploit an established relationship between the two organisations rather than directly breaching the final target’s perimeter.

After gaining access, the attackers installed tools including OpenSSH, SoftPerfect Network Scanner, socks5. exe and Mimikatz. They used network-scanning software to identify systems and Mimikatz to extract credentials from compromised machines. Evidence also showed access to KeePassXC password managers installed on several computers, suggesting an attempt to obtain credentials stored in password databases.

The operators moved between Windows systems through Remote Desktop Protocol and reached Linux machines using Secure Shell connections. PsExec and PAExec, legitimate administration utilities frequently abused in cyberattacks, were used to distribute the ransomware across the network. A reverse SSH tunnel connected compromised systems with command-and-control infrastructure.

GenieLocker’s Windows build is primarily written in C and compiled with Microsoft Visual C++ libraries. It includes checks designed to detect debuggers and analysis environments. A watchdog component monitors the integrity of its code and can terminate the malware when modification or inspection is detected.

The Windows version also requires a secret hexadecimal argument before it begins encryption. The value must pass a hard-coded SHA-256 validation process. This mechanism helps operators control execution, limits accidental deployment and may reduce the possibility of the ransomware activating inside automated malware-analysis systems.

Before encrypting files, the malware can terminate processes and stop services associated with databases, backups, security software, office applications, email platforms and virtualisation tools. Shutting down those services releases files that might otherwise remain locked by running applications and increases the amount of data available for encryption.

The Linux and ESXi variants have fewer anti-analysis features but include functions tailored to virtual infrastructure. They can stop active virtual machines before encrypting their disks and can target VMware’s standard /vmfs/volumes storage path. Operators may configure worker threads, delayed execution and daemon-style operation.

All variants use the open-source libsodium cryptographic library. File contents are encrypted with XChaCha20-Poly1305, while encryption keys are protected using Curve25519-XSalsa20-Poly1305. The malware supports partial encryption, processing selected portions of larger files to accelerate disruption while leaving the data unusable.

Encrypted files receive extensions generated from an identifier associated with the affected system. The ransomware does not routinely leave a conventional ransom note containing payment instructions or communication details. Its operators must instead provide demands through another channel during the intrusion.

Forensic examinations of attributed attacks found no evidence that Toy Ghouls copied data before encryption. The group does not operate a public leak site and has not followed the double-extortion model used by many ransomware gangs, which combine encryption with threats to publish stolen information.