New GenieLocker Ransomware Attacks Windows, ESXi, and Linux Instances

Cybersecuritynews •Abinaya • July 30, 2026

Share: View original

GenieLocker, a newly identified ransomware linked to the financially motivated Toy Ghouls group, targets Windows, Linux, and VMware ESXi systems and has primarily attacked Russia’s manufacturing sector since March 2026. The Toy Ghouls group, also known as Bearlyfy, Labubu, and Laboo.boo, previously relied on ransomware families such as LockBit, Babuk, and RedAlert. The transition to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Toy Ghouls Launch GenieLocker Ransomware Targeting Russian Manufacturing The Toy Ghouls group, also known as Bearlyfy, has introduced a new ransomware called GenieLocker, active since March 2026. This ransomware targets Windows, Linux, and VMware ESXi systems, primarily affecting the manufacturing sector in Russia. The group previously relied on third-party ransomware like LockBit and Babuk but has now developed its own custom ransomware. Attackers typically gain access through compromised OpenVPN connections, exploiting trusted relationships with partners. After breaching networks, they deploy GenieLocker using legitimate tools like PsExec and PAExec. The group has not engaged in data exfiltration or double-extortion tactics, focusing solely on file encryption. Forensic analysis indicates that they maintain a consistent modus operandi across their attacks, including lateral movement via RDP and SSH. The current status of the attacks remains active, with organizations urged to bolster their defenses against this emerging threat. 5 sources 72

Extracted Entities

APT Groups (1)

Attack Types (1)

Industries (1)

Malware (2)

GenieLocker RedAlert

Platforms (3)

Linux VMware ESXi Windows

Ransomware Groups (5)

Babuk Bearlyfy Laboo.boo Labubu Lockbit