## GenieLocker Ransomware: How Toy Ghouls Are Hitting Windows, Linux & ESXi
A new ransomware family called GenieLocker is actively targeting Windows, Linux, and VMware ESXi environments — and it skips the usual playbook. No ransom note. No leak site. No confirmed data exfiltration. Just silent, cross-platform encryption.
The group behind it, Toy Ghouls (aka Bearlyfy), used to rely on LockBit, Babuk, and RedAlert. Building a custom encryptor in-house means no shared code signatures and a much harder attribution trail.
Attack chain breakdown:
- 🔑 Initial access via stolen partner VPN credentials
- 🔍 Network discovery with SoftPerfect Network Scanner
- 🔓 Credential theft via Mimikatz + KeePassXC
- 🖥️ Lateral movement over RDP (Windows) / SSH (Linux)
- 📡 Persistence through reverse SSH tunnels
- 💻 Mass deployment via PsExec/PAExec
- 💀 ESXi VMs shut down, then encrypted — cascading outages
On the crypto side: GenieLocker uses libsodium — XChaCha20-Poly1305 for file encryption, Curve25519-based key wrapping sealed against an attacker-controlled public key. No known decryptor exists.
The Windows build carries anti-debugging checks, a self-integrity watchdog thread, and a hex "secret argument" gate to dodge sandboxes. The Linux/ESXi build is leaner, but purpose-built to target /vmfs/volumes and take down virtualized infrastructure at scale.
I wrote a full technical breakdown covering the attack chain, encryption internals, IOCs, SOC detection queries (including a ready PowerShell snippet), and a hardening checklist for VPN/ESXi/backup strategy 👇
🔗 https://www.xpert4cyber.com/2026/07/genielocker-ransomware-esxi-attack.html
If you run ESXi or grant third-party VPN access, worth a read before it's your incident report.
Top comments (0)