Kaspersky researchers have dissected GenieLocker, a new custom ransomware family active since March 2026, attributed to the financially motivated Toy Ghouls (also known as Bearlyfy/Labubu) extortion group. The malware targets Windows, Linux, and ESXi systems, replacing the group's previous reliance on third-party ransomware like LockBit, RedAlert, and Babuk. The Windows PE variant features anti-debugging via watchdog threads and CRC32 code integrity checks, a secret argument requirement to evade sandboxes, and uses XChaCha20-Poly1305 with Curve25519-XSalsa20-Poly1305 key encryption via libsodium. The ELF variant for Linux/ESXi is simpler, lacking anti-debug and exclusion lists, but adds ESXi-specific features like double-fork daemonization and Welcome Message modification. Notably, GenieLocker does not drop ransom notes on disk — attackers deliver demands manually — likely to evade detection heuristics. Attacks have targeted Russian manufacturing, construction, and financial sectors, with no evidence of data exfiltration. IoCs and detection signatures are provided.
