GenieLocker is a new custom ransomware family first observed in March 2026, utilized by the financially motivated threat actor known as Toy Ghouls (also referred to as Bearlyfy). This group, which previously relied on third-party ransomware like LockBit and Babuk, has developed GenieLocker to reduce external dependencies. The malware features both Windows (PE) and Linux/ESXi (ELF) variants, primarily targeting industrial and manufacturing sectors within the Russian Federation.
Technically, GenieLocker incorporates several sophisticated evasion techniques, including a mandatory "secret argument" for execution to bypass sandboxes and a watchdog thread that monitors for debuggers. Unlike many ransomware strains, it does not leave ransom notes on the victim's system, requiring attackers to deliver demands manually. For encryption, it leverages the libsodium library, employing the XChaCha20-Poly1305 algorithm to perform partial file encryption based on user-defined percentages.
Top comments (0)