GenieLocker Ransomware Targets Russian Manufacturers on Windows, Linux, and ESXi
Do Son 
ESXi version description
At a glance
| Field | Detail |
|---|---|
| Malware family | GenieLocker (PE builds for Windows; ELF builds for Linux and ESXi) |
| Threat actor | Toy Ghouls (also tracked as Bearlyfy, Labubu, Laboo.boo) attribution from OSINT, corroborated by Kaspersky TTP analysis |
| Targets | Organizations in the Russian Federation; primarily manufacturing, followed by construction, financial services, retail, and technology |
| Delivery vector | Stolen VPN credentials via a trusted external partner’s OpenVPN connection |
| Key capabilities | Cross-platform encryption (XChaCha20-Poly1305 / libsodium), process and service termination, anti-debugging, no ransom note embedded |
| Source | Kaspersky Securelist (Fedor Sinitsyn and Yanis Zinchenko), July 30, 2026 |
TL;DR
Kaspersky has documented GenieLocker ransomware, a new custom-built family active since March 2026. The malware targets Windows, Linux, and VMware ESXi machines in Russia, primarily in manufacturing. OSINT links it to Toy Ghouls, a group that previously rented third-party ransomware. Kaspersky’s incident analysis found TTPs consistent with that attribution.
Why GenieLocker matters
Toy Ghouls previously ran attacks using RedAlert, LockBit, and Babuk – all third-party ransomware families. GenieLocker represents their move to a custom build. According to Kaspersky, the rollout “marks a major upgrade to the group’s ransomware toolkit.” Cross-platform coverage across Windows, Linux, and ESXi lets a single operator knock out entire mixed-environment networks in one campaign.
According to Kaspersky’s KSN telemetry, detections are overwhelmingly concentrated in the Russian Federation, with manufacturing the hardest-hit sector, followed by construction, financial services, retail, and technology.
Delivery and infection chain
In the documented March 2026 incident, attackers entered through an OpenVPN connection linked to a trusted external partner. They likely used stolen credentials to pass through what looked like a legitimate connection. After breaching the network, they deployed OpenSSH, a network scanner, and Mimikatz to map the environment and harvest credentials. The attackers also accessed KeePassXC databases on several machines, likely to extract stored passwords. Lateral movement ran over RDP for Windows systems and SSH for Linux servers. Mass deployment of GenieLocker used the legitimate PsExec and PAExec utilities. Command-and-control relied on a reverse SSH tunnel to an external server.
How GenieLocker works
Windows variant
The Windows build requires a “secret argument,” a hex string passed at launch before it will run. This check hashes the argument with SHA-256 and compares it to a hardcoded value. Kaspersky notes the likely purpose is “to avoid execution on sandboxes and other automated analysis environments.” It also runs a watchdog thread that checks for debuggers every 500 milliseconds and terminates the process if any are detected. Before encrypting, GenieLocker kills databases, email clients, virtualisation processes, and security services. Then it searches local drives and network shares for files to encrypt.
Encryption scheme
Both the Windows and Linux/ESXi builds use XChaCha20-Poly1305 for file content, with a unique key and nonce per file. Per-file keys are then protected using the Curve25519-XSalsa20-Poly1305 scheme, with the attacker’s master public key hardcoded in the binary. The malware uses the open-source libsodium library for all cryptographic operations. GenieLocker embeds no ransom note in the filesystem, so the attackers must deliver payment demands manually during the attack.
Linux and ESXi variant
The ELF build is simpler than its Windows counterpart. It drops the secret argument and anti-debugging checks. However, it gains ESXi-specific features, including the ability to stop running virtual machines before encrypting their disk images, daemonize its process, and modify the ESXi welcome message. The command-line interface mirrors LockBit’s output styling, which Kaspersky says reinforces the theory that its creators aimed to build a LockBit-style replacement for their own operations.
No exfiltration, no data-leak site
Forensic analysis of the March 2026 incident found no evidence of data exfiltration. Kaspersky states this is “typical behavior for this threat actor.” Toy Ghouls do not run a data-leak website. This distinguishes them from many current ransomware groups that use double-extortion tactics to pressure victims.
Detection and defense
Kaspersky detects this malware as Trojan-Ransom.Win64.Agent.genie, HEUR:TrojanRansom.Win64.Generic, and Trojan-Ransom.Linux.Agent.genie. The full Kaspersky Securelist report includes Windows and Linux file hashes and the single confirmed C2 IP address. Key defensive steps include restricting VPN access from third-party networks, monitoring for PsExec and PAExec-based lateral movement, watching for reverse SSH tunnels, protecting KeePass and credential stores, and backing up ESXi disk images offline. Separating OT and IT networks limits blast radius if an attacker enters through a trusted supply-chain connection.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
