GenieLocker Ransomware Targets Windows, ESXi, and Linux Systems

Key Takeaways

• GenieLocker is a new ransomware variant, developed by the financially motivated Toy Ghouls group, targeting Windows, Linux, and VMware ESXi systems.
• The attacks have primarily impacted Russia’s manufacturing sector since March 2026.
• Initial access often involves compromised OpenVPN connections and stolen credentials from external partners.
• GenieLocker includes anti-debugging features and a “secret argument” for its Windows variant, while ESXi versions focus on virtual machine disruption.
• Defenders should prioritize VPN security, credential management, and monitoring for lateral movement tools to mitigate risk.

A new ransomware strain named GenieLocker has emerged, linked to the financially motivated cybercrime collective known as Toy Ghouls. This sophisticated malware is designed to encrypt systems running Windows, Linux, and VMware ESXi, with a primary focus on Russia’s manufacturing sector since its observed activity began in March 2026.

The Toy Ghouls group, also identified by aliases such as Bearlyfy, Labubu, and Laboo.boo, previously relied on established ransomware families like LockBit, Babuk, and RedAlert. The shift to GenieLocker signifies a strategic move to reduce their dependence on third-party malware, granting them enhanced control and customization over their ransomware operations.

Investigations into a late-March intrusion revealed that threat actors typically gain initial access through OpenVPN connections originating from external partner networks. They are believed to leverage stolen, yet valid, credentials, exploiting the inherent trust between the victim organization and its partners.

Once inside the network perimeter, the attackers deploy a suite of tools for reconnaissance and lateral movement. This includes OpenSSH, socks5.exe, SoftPerfect Network Scanner for system mapping, and Mimikatz for credential harvesting.

GenieLocker Ransomware Attack Mechanics

Further analysis showed that the operators also targeted installed KeePassXC password managers, likely seeking additional credentials stored within password databases. Lateral movement within Windows environments is primarily achieved via Remote Desktop Protocol (RDP), while Linux hosts are accessed through SSH.

For ransomware deployment across compromised systems, the attackers utilize PsExec and PAExec. A reverse SSH tunnel is concurrently established to maintain a covert channel to their command-and-control (C2) infrastructure. The Windows variant of GenieLocker is a PE-based ransomware program, predominantly written in C and compiled with Microsoft Visual C++ libraries.

This Windows version incorporates anti-debugging checks, specifically using IsDebuggerPresent and CheckRemoteDebuggerPresent, alongside a watchdog thread designed to verify the integrity of its own code section. Any detection of analysis or modification triggers the malware to self-terminate.

A notable feature of the Windows variant is its requirement for a “secret argument”—a hexadecimal value that must successfully pass a hardcoded SHA-256 validation check before the encryption process can commence. This mechanism likely serves to prevent accidental execution and to hinder analysis in sandbox environments.

Before initiating file encryption, GenieLocker systematically terminates a range of processes and services associated with databases, backup solutions, security tools, Microsoft Office applications, virtual machines, and email clients. It actively scans both local and network drives, while intentionally avoiding critical Windows folders and executable file types that could render the host inoperable.

Securelist by Kaspersky said in a report shared with Cyber Security News that GenieLocker employs the libsodium cryptographic library, utilizing XChaCha20-Poly1305 for file encryption. Per-file keys are further protected using Curve25519-XSalsa20-Poly1305 and an embedded public key controlled by the attacker.

Interestingly, the ransomware can be configured to encrypt only a specified percentage of a file. However, even when a zero-percent setting is applied, it still encrypts the initial chunk of the file.

The Linux and ESXi ELF variants of GenieLocker are comparatively less complex than their Windows counterpart, notably lacking both the “secret argument” and anti-debugging functionalities. Nevertheless, the ESXi version includes specialized options for virtualized environments, such as daemonization, worker-thread configuration, delayed execution, and a default target path of /vmfs/volumes.

Crucially, the ESXi variant possesses the capability to halt virtual machines and encrypt their associated virtual disks, posing a significant operational threat to virtualized infrastructure. Unlike many contemporary ransomware groups, the Toy Ghouls collective has not been observed engaging in double extortion tactics or operating a public data leak site.

What You Should Do

• Regularly review and secure all VPN access points, revoking any stale or unnecessary partner credentials.
• Implement robust monitoring for the use of tools like PsExec, PAExec, Mimikatz, and the establishment of reverse SSH tunnels, as these are common indicators of compromise.
• Ensure that critical offline backups are meticulously protected and segmented from both Windows and ESXi environments to prevent compromise.
• Maintain up-to-date security patches and configurations across all systems, especially those exposed to external networks or used for remote access.
• Employ strong multi-factor authentication (MFA) for all accounts, particularly for administrative access and external partner connections.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.