The new GenieLocker ransomware family has been active since March 2026.
Who is deploying GenieLocker and where it is hitting
Kaspersky attributes the new, custom encryption Trojan to the financially motivated actor known as Toy Ghouls (also tracked as Bearlyfy, Labubu and Laboo.boo). According to Kaspersky telemetry, "GenieLocker detections are overwhelmingly concentrated on endpoints located in the Russian Federation." In the March 2026 campaign the highest-impact sector was manufacturing, followed by construction, financial services, retail and technology.
How the attackers gained access and moved inside networks
In a reported incident at the end of March 2026 the intruders gained initial access through an OpenVPN connection originating from an external partner’s network, using stolen but still-valid credentials. After the foothold was established the actors deployed a suite of tools for discovery, credential theft and persistence: OpenSSH, socks5.exe, SoftPerfect Network Scanner and Mimikatz. For discovery they used SoftPerfect Network Scanner and for credential harvesting they used Mimikatz; forensic traces also indicate attempts to access already-installed KeePassXC databases.
Lateral movement was achieved with RDP for Windows hosts and SSH for Linux servers. Widespread deployment of the encryption Trojan was performed with legitimate administrative utilities PsExec and PAExec, and the attackers additionally created a reverse SSH tunnel to their command‑and‑control infrastructure.
Technical profile: what GenieLocker does on Windows, Linux and ESXi
Kaspersky analysts recovered multiple samples in two main variants: PE builds for Windows and ELF builds for Linux and ESXi. Both builds use the open‑source libsodium library for cryptography, but the Windows and Linux/ESXi samples differ significantly in features and complexity.
- Windows sample (MD5: 5d62c1349b8981c396c9a23f4f8f053c) — primarily written in C and linked with C++ libraries; includes anti‑debugging, process termination, service shutdown and sophisticated encryption logic. The Windows build requires a first argument — a hex "secret argument" — that is converted to bytes and hashed with SHA‑256 and compared to a hardcoded value; if the check passes the program proceeds.
- Linux/ESXi sample (MD5: 9201e35e2993612612919a3c71302cab) — simpler: no secret argument, no anti‑debugging or exclusion lists, but ESXi‑specific features include double‑fork daemonization, the ability to modify the ESXi Welcome Message (/etc/vmware/welcome) and a launch‑delay option. Its help output mirrors LockBit’s styling, suggesting the authors sought a LockBit‑style replacement for their operations.
Across platforms, file encryption uses the AEAD cipher XChaCha20‑Poly1305 with a unique key and nonce per file; file keys are encrypted with Curve25519‑XSalsa20‑Poly1305 using a hardcoded attacker master public key. On Windows the default chunk size is 0x1000000 bytes; on ESXi and Linux the default chunk size is 0x400000. GenieLocker always encrypts the first chunk at the beginning of the file and, when configured, encrypts a percentage of remaining chunks at random positions within the file.
Operational controls and anti‑analysis techniques
The Windows build contains layered anti‑debugging checks. After validating the secret argument it starts a watchdog thread that scans for debuggers every 500 milliseconds and will terminate the process if checks fail. The watchdog also computes and verifies a CRC32 of its .text section on every loop to detect code modification. The malware maintains numerous exclusion lists — folder names, specific system files and a long list of file extensions are skipped to avoid corrupting system files — and it checks host names against a whitelist (empty in the examined sample).
Before encryption the Trojan terminates processes that could lock target files (examples include sql, oracle, excel, outlook, vmwp, vmms and mssqlserver) and stops services such as vss, msexchange, veeam and others via SERVICE_CONTROL_STOP. Rather than dropping on‑disk ransom notes, GenieLocker leaves no built‑in contact information: attackers deliver ransom demands and negotiation details manually during the attack.
Impact, detections and indicators of compromise
During the observed incident the Windows PE build encrypted files on compromised Windows hosts; on Linux and ESXi the actors stopped active virtual machines and encrypted their disks with the ELF build. Kaspersky’s forensic analysis found no evidence of data exfiltration — consistent with Toy Ghouls’ prior behavior: the group "have not employed a double‑extortion model and do not run a data‑leak website." Kaspersky products detect the malware as Trojan‑Ransom.Win64.Agent.genie, HEUR:TrojanRansom.Win64.Generic and Trojan‑Ransom.Linux.Agent.genie.
Selected indicators published by Kaspersky include multiple MD5 hashes and filenames for the Windows samples (for example, 5D62C1349B8981C396C9A23F4F8F053C mapped to genie_encrypt.exe) and the Linux/ESXi build MD5 9201E35E2993612612919a3c71302CAB (observed as vzdump). Kaspersky notes a command‑and‑control host at 89[.]125.66.101. Additional intelligence is available to customers of the Kaspersky Threat Intelligence Reporting service (contact: intelreports@kaspersky.com).
What this means for security teams, manufacturing firms, and enterprise operators
- Security teams and technologists: Expect a cross‑platform, libsodium‑based encryption scheme and prepare for file chunking behavior (first chunk always encrypted; configurable percentage for remaining chunks). Watch for the Windows "secret argument" execution pattern, the watchdog anti‑debugging behavior and the presence of journal and lock files using the distinctive extension (example: .03ffc1c4a3da0f02).
- Manufacturing and other targeted enterprises: The March campaign concentrated on manufacturing operations in the Russian Federation; firms in that sector should prioritize detection of lateral movement tools (PsExec/PAExec), OpenVPN session anomalies from partner networks, and signs of reverse SSH tunnels and credential dumping tools such as Mimikatz.
- Enterprise operators of ESXi environments: The ELF sample targets /vmfs/volumes by default, can daemonize via double‑fork and may modify the ESXi welcome message; monitoring for sudden VM shutdowns and unexpected changes to /etc/vmware/welcome may be useful indicators.
GenieLocker demonstrates a deliberate shift by Toy Ghouls from third‑party crypters to a home‑grown, multi‑platform ransomware that standardizes its cryptographic backbone across Windows, Linux and ESXi. Kaspersky’s report provides concrete IOCs and behavior slices; for operators in affected sectors the immediate questions are operational: who is connecting via partner VPNs, which credentials remain in circulation and how quickly can teams detect the pre‑encryption discovery and lateral‑movement tools detailed above.
Source: https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/
