A ransomware group tracked under several aliases — Toy Ghouls, Bearlyfy, Labubu, and Laboo.boo — has rolled out a homegrown encryption tool called GenieLocker, capable of hitting Windows machines, Linux servers, and VMware ESXi hosts within a single intrusion. Security researchers at Kaspersky’s Securelist say the group has used it against manufacturing-sector targets in Russia since March 2026.

From Borrowed Tools to In-House Malware

Toy Ghouls previously operated using well-known ransomware families it didn’t build itself, including LockBit, Babuk, and RedAlert. Building GenieLocker in-house removes that dependency and gives the group full control over how its ransomware behaves, evolves, and evades detection — a pattern increasingly common among mid-tier ransomware crews looking to shed reliance on leaked builders or ransomware-as-a-service affiliates.

How the Attacks Unfold

In an intrusion researchers examined from late March, the attackers got their initial foothold through an OpenVPN connection tied to an external partner network, apparently using stolen but legitimate credentials rather than exploiting a software flaw. That’s a notable detail on its own: the trust relationship between a victim and its business partner became the entry point, not a technical vulnerability.

Once inside, the operators built out a fairly conventional but effective toolkit. They installed OpenSSH and a SOCKS5 proxy for covert connectivity, ran SoftPerfect Network Scanner to map the internal network, and deployed Mimikatz to harvest credentials from memory. Investigators also found signs the attackers had gone after KeePassXC password vaults installed on compromised machines, hunting for stored logins that could unlock further systems. From there, they moved laterally using Remote Desktop Protocol on Windows hosts and SSH on Linux systems, ultimately pushing the ransomware payload out with PsExec and PAExec while keeping a reverse SSH tunnel open back to their command infrastructure.

Built to Resist Analysis

The Windows build of GenieLocker is written in C and compiled with standard Microsoft Visual C++ tooling, but it comes with defensive engineering baked in. It checks for debuggers using calls like IsDebuggerPresent and CheckRemoteDebuggerPresent, and runs a watchdog thread that continuously verifies its own code hasn’t been tampered with or is being inspected — killing itself if it senses analysis in progress.

Perhaps more unusual is a requirement built into the Windows variant: execution won’t proceed without a “secret argument,” a hexadecimal value checked against a hardcoded SHA-256 hash before encryption begins. In practice, this makes it much harder for malware sandboxes or curious researchers to trigger the payload without knowing the correct value, while ensuring the ransomware only fires when the operators intend it to.

Before it starts encrypting, GenieLocker methodically shuts down processes tied to databases, backup software, security tools, Office applications, virtualization software, and email clients — clearing the obstacles that might otherwise interrupt or block file encryption. It then sweeps local and network drives, carefully steering around core Windows system folders and executable file types to avoid bricking the machine outright.

Modern Cryptography Under the Hood

For the actual encryption, GenieLocker relies on the libsodium library, using XChaCha20-Poly1305 to encrypt file contents and Curve25519-XSalsa20-Poly1305 to protect the per-file keys against an embedded public key controlled by the attackers — a well-regarded, modern cryptographic combination that leaves little room for a free decryption shortcut. Interestingly, the malware supports partial-file encryption, letting operators set what percentage of a file gets scrambled, though researchers found it still encrypts at least the first chunk of a file even when configured for zero percent.

Lighter Builds for Linux and ESXi

The Linux and ESXi versions, built as ELF binaries, strip out the secret-argument gate and the anti-debugging protections found on Windows, favoring simplicity. Instead, they add features tailored to virtualized environments: the ability to run as a background daemon, configurable worker threads, delayed execution timers, and a default target directory of /vmfs/volumes — the standard datastore path on ESXi hosts. That lets GenieLocker halt running virtual machines and encrypt their virtual disk files directly, which can knock out dozens of workloads from a single host compromise.

No Leak Site, So Far

Unlike many contemporary ransomware operations, Toy Ghouls has not been observed running a public data-leak site or practicing double extortion by threatening to publish stolen files. That could change as the group matures its GenieLocker operation, but for now its pressure model appears to rest on encryption alone.

Defensive Recommendations

• Audit and tightly scope VPN access granted to external partners, and rotate or revoke credentials that haven’t been reviewed recently.
• Watch for the specific toolset seen in these intrusions: PsExec, PAExec, Mimikatz, SoftPerfect Network Scanner, and reverse SSH tunnels.
• Ensure backups, especially those covering ESXi datastores, are stored offline or immutable and are not reachable from the same credentials used elsewhere in the network.
• Apply the same monitoring rigor to Linux and ESXi hosts as to Windows endpoints; this campaign shows attackers treating them as equally valuable targets.