New GenieLocker Ransomware Encrypts Windows, Linux and VMware ESXi Systems

GenieLocker is a custom ransomware family linked to the Toy Ghouls group (also known as Bearlyfy or Labubu). It can encrypt systems running Windows, Linux, and VMware ESXi, with a current focus on the manufacturing sector and related industries in Russia.

This ransomware strain replaces the group’s earlier dependence on third-party lockers such as RedAlert, LockBit, and Babuk, providing a unified encryption framework across on-premises endpoints and virtualized infrastructures.

New GenieLocker Ransomware

Since 2025, Toy Ghouls have actively targeted Russian organizations, particularly in the industrial, construction, telecommunications, financial, and retail sectors.

In a March 2026 campaign reported by Kaspersky, the group widely deployed GenieLocker across Windows workstations, Linux servers, and ESXi hosts within a single victim’s environment.

Notably, telemetry indicates a significant geographic concentration in the Russian Federation, and there is currently no evidence that the group has adopted a double-extortion model or operates a leak site.

In the incident mentioned, Toy Ghouls gained initial access via an OpenVPN connection from a trusted external partner, exploiting stolen but valid credentials rather than a vulnerability in the VPN appliance.

After compromising the network, they installed various tools, including OpenSSH, SoftPerfect Network Scanner, SOCKS5 proxies, and Mimikatz. They attempted to harvest passwords from existing KeePassXC vaults.

The group relied on RDP for lateral movement to Windows machines and SSH for Linux. They used PsExec and PAExec to deploy ransomware widely, with a reverse SSH tunnel established for command-and-control communication.

The Windows version of GenieLocker (example MD5: 5d62c1349b8981c396c9a23f4f8f053c) is a C/C++ Trojan that employs the libsodium library and implements a multi-stage anti-analysis process, as reported by SecureList.

Execution requires a “secret” hex argument that is SHA-256-validated against a hardcoded value, effectively preventing sandbox execution and unauthorized reuse by other actors.

The malware includes anti-debugging measures via IsDebuggerPresent and CheckRemoteDebuggerPresent checks, along with a watchdog thread that continuously inspects the CRC32 of its .text section. The program terminates if any code tampering is detected.

Before encryption, GenieLocker applies significant exclusions, avoiding core operating system directories such as Windows, Program Files, and System Volume Information to prevent disruption of the OS and its execution chain.

It enumerates all local and network drives, terminates database, backup, virtualization, office, and browser processes, and halts related services (including VSS, SQL, backup, VMware, and OpenVPN agent services) to maximize file accessibility for encryption.

Cross-Platform Cryptography and Focus on ESXi

GenieLocker utilizes XChaCha20-Poly1305 AEAD for file and metadata encryption across Windows, Linux, and ESXi systems. It protects per-file keys using Curve25519-XSalsa20-Poly1305 with a hardcoded attacker public key.

Files are encrypted in large chunks (default 0x1000000 bytes on Windows, 0x400000 on Linux/ESXi), based on a configurable percentage, with at least the initial chunk always being encrypted to ensure effective damage.

Each file receives a hardcoded extension (e.g., .03ffc1c4a3da0f02), along with a lock file and a journal file for concurrency control and integrity checking via CRC32 and BLAKE2b-256 digest of all original chunks.

The ESXi/Linux ELF variant (MD5: 9201e35e2993612612919a3c71302cab) is simpler than its Windows counterpart, lacking the secret argument and anti-debugging logic, but incorporates virtualization-specific features such as double-fork daemonization and modification of the ESXi welcome message in /etc/vmware/welcome.

Command-line options enable operators to set encryption percentage, worker thread count, recursive directory traversal, delayed start, daemon mode, and log file location, with a default target of /vmfs/volumes, clearly indicating that ESXi is the primary focus.

Unlike many modern ransomware variants, GenieLocker does not automatically generate ransom notes or embed contact information into the payload.

Instead, the Toy Ghouls deliver ransom demands manually during or after the intrusion, likely to evade note-based behavioral detection and to enhance their “human-driven” extortion approach.

Kaspersky identifies this ransomware family under multiple verdicts, including Trojan-Ransom.Win64.Agent.genie, HEUR:TrojanRansom.Win64.Generic, and Trojan-Ransom.Linux.Agent.genie, and has provided further indicators through its Threat Intelligence Reporting service.

Indicators of Compromise (IOC)

File hashes

Type	Platform	Indicator (MD5)	Notes
Hash	Windows	A50EAAF514F4F84E61CA2455A8789753	kftd.exe, genie_encrypt.exe
Hash	Windows	F08F476F26B01D142CA73923DE65FC0C	GenieLocker sample
Hash	Windows	FD46A80C2F45577263328984EDF7F4DC	GenieLocker sample
Hash	Windows	DE3CFBB50F66079BFEE20A6F64E59433	GenieLocker sample
Hash	Windows	780C8F4C6F077DA4DA96582987920362	GenieLocker sample
Hash	Windows	D87D0B01D95ACC936B7DC47B8F41937A	run.exe, genie_encrypt.exe
Hash	Windows	34A7F28E0BB69B0D49BACC88BDF20AC1	run.exe, run2.exe, genie.exe
Hash	Windows	5D62C1349B8981C396C9A23F4F8F053C	genie_encrypt.exe (analyzed sample)
Hash	Windows	A8842616C9057D5CF6E1FE1FA8C3C160	GenieLocker sample
Hash	Windows	34B8828635F88078735799A3C1AC8E28	GenieLocker sample
Hash	Windows	D3E06EB34D8EEE7EF92CAC3AD0A20FF5	GenieLocker sample
Hash	Windows	C68B6862725777651085650DB34947FC	consultant.exe
Hash	Windows	9CD514FF2809CE0B993E3B8649E82A94	GenieLocker sample
Hash	Windows	824CA1E906CC073EE5B0F3519DF69A8F	GenieLocker sample
Hash	Windows	25480DAD40152EF3D0C6D38EECC9BD9B	GenieLocker sample
Hash	Windows	7DAD78584795AA5C160520CC6ACCF260	GenieLocker sample
Hash	Windows	18F61C6D686CFFD131C9FD3F3437064B	tempo.exe, kernel.exe
Hash	Windows	9969A8221312DBA70DD5CBDDF83A146C	GenieLocker sample
Hash	Windows	F7B9E36E94163A9A303160945F99267A	GenieLocker sample
Hash	Windows	B893EAFED0659F70D4AC250F09073723	GenieLocker sample
Hash	Windows	D661CF666B9ACBAB7CFEAE1127A261A9	genie.exe
Hash	Windows	3A4479B51890373BFC4A011EF41FE376	GenieLocker sample
Hash	Windows	58C0DDA52B8F069660166D61FD74F911	GenieLocker sample
Hash	Linux/ESXi	9201E35E2993612612919A3C71302CAB	vzdump (GenieLocker ELF)

Network indicators

Type	Indicator	Description
C2 IP	89.125.66.101	Reported GenieLocker command‑and‑control endpoint

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.