New GenieLocker Ransomware Encrypts Windows, Linux and VMware ESXi Systems

Gbhackers •Divya • July 30, 2026

GenieLocker is a custom ransomware family linked to the Toy Ghouls group (also known as Bearlyfy or Labubu). It can encrypt systems running Windows, Linux, and VMware ESXi, with a current focus on the manufacturing sector and related industries in Russia. This ransomware strain replaces the group’s earlier dependence on third-party lockers such as RedAlert, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Toy Ghouls Launch GenieLocker Ransomware Targeting Russian Manufacturing The Toy Ghouls group, also known as Bearlyfy, has introduced a new ransomware called GenieLocker, active since March 2026. This ransomware targets Windows, Linux, and VMware ESXi systems, primarily affecting the manufacturing sector in Russia. The group previously relied on third-party ransomware like LockBit and Babuk but has now developed its own custom ransomware. Attackers typically gain access through compromised OpenVPN connections, exploiting trusted relationships with partners. After breaching networks, they deploy GenieLocker using legitimate tools like PsExec and PAExec. The group has not engaged in data exfiltration or double-extortion tactics, focusing solely on file encryption. Forensic analysis indicates that they maintain a consistent modus operandi across their attacks, including lateral movement via RDP and SSH. The current status of the attacks remains active, with organizations urged to bolster their defenses against this emerging threat. 5 sources 72

Extracted Entities

New GenieLocker Ransomware Encrypts Windows, Linux and VMware ESXi Systems

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Industries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (3)