11 minhigh
Toy Ghouls’ new toy: the GenieLocker ransomware
GenieLocker is a custom ransomware family deployed by the Toy Ghouls threat actor since March 2026, targeting Russian organizations primarily in manufacturing. It features Windows and Linux/ESXi variants using libsodium-based XChaCha20-Poly1305 and Curve25519-XSalsa20-Poly1305 cryptography. The Windows build includes anti-debugging, a secret argument for sandbox evasion, process/service termination, and file exclusion lists. The ESXi/Linux build targets /vmfs/volumes, supports daemonization, and modifies the ESXi welcome message. Unlike typical ransomware, no ransom notes are dropped; attackers deliver demands manually. No data exfiltration was observed, consistent with Toy Ghouls' non-double-extortion model.
Sens:▲ 24h
Showing defanged values
- filenamegenie_encrypt.exePrimary executable name used by GenieLocker Windows variant for file encryption.
- ip89[.]125[.]66[.]101C2 server used by Toy Ghouls; attackers established a reverse SSH tunnel to communicate with this IP during the March 2026 incident.
- md518f61c6d686cffd131c9fd3f3437064bWindows GenieLocker sample (tempo.exe, kernel.exe).
- md525480dad40152ef3d0c6d38eecc9bd9bWindows GenieLocker sample.
- md534a7f28e0bb69b0d49bacc88bdf20ac1Windows GenieLocker sample distributed as run.exe, run2.exe, or genie.exe.
- md534b8828635f88078735799a3c1ac8e28Windows GenieLocker sample.
- md53a4479b51890373bfc4a011ef41fe376Windows GenieLocker sample.
- md558c0dda52b8f069660166d61fd74f911Windows GenieLocker sample.
- md55d62c1349b8981c396c9a23f4f8f053cPrimary Windows GenieLocker sample (genie_encrypt.exe); PE build compiled with MSVC, uses libsodium for XChaCha20-Poly1305 encryption.
- md5780c8f4c6f077da4da96582987920362Windows GenieLocker sample.
- md57dad78584795aa5c160520cc6accf260Windows GenieLocker sample.
- md5824ca1e906cc073ee5b0f3519df69a8fWindows GenieLocker sample.
- md59201e35e2993612612919a3c71302cabLinux/ESXi GenieLocker ELF sample (vzdump); targets /vmfs/volumes, supports daemonization and welcome message modification.
- md59969a8221312dba70dd5cbddf83a146cWindows GenieLocker sample.
- md59cd514ff2809ce0b993e3b8649e82a94Windows GenieLocker sample.
- md5a50eaaf514f4f84e61ca2455a8789753Windows GenieLocker sample distributed as kftd.exe or genie_encrypt.exe.
- md5a8842616c9057d5cf6e1fe1fa8c3c160Windows GenieLocker sample.
- md5b893eafed0659f70d4ac250f09073723Windows GenieLocker sample.
- md5c68b6862725777651085650db34947fcWindows GenieLocker sample distributed as consultant.exe.
- md5d3e06eb34d8eee7ef92cac3ad0a20ff5Windows GenieLocker sample.
- md5d661cf666b9acbab7cfeae1127a261a9Windows GenieLocker sample (genie.exe).
- md5d87d0b01d95acc936b7dc47b8f41937aWindows GenieLocker sample (run.exe, genie_encrypt.exe).
- md5de3cfbb50f66079bfee20a6f64e59433Windows GenieLocker sample.
- md5f08f476f26b01d142ca73923de65fc0cWindows GenieLocker sample.
- md5f7b9e36e94163a9a303160945f99267aWindows GenieLocker sample.
- md5fd46a80c2f45577263328984edf7f4dcWindows GenieLocker sample.
Detection / Hunteropenrouter
What Happened
A criminal group called Toy Ghouls has built their own ransomware called GenieLocker, which can attack Windows computers, Linux servers, and VMware ESXi virtual machine systems. They have been using it since March 2026 mainly against manufacturing companies in Russia. The ransomware encrypts files using strong, modern encryption so victims cannot access their data without a decryption key. Unlike most ransomware, it does not leave ransom notes on the computers — instead the attackers contact victims directly. The group does not steal data for leverage, they only encrypt files. Organizations running Windows, Linux, or ESXi systems should ensure they have offline backups, restrict remote access, and monitor for unusual process termination or file encryption activity.
Key Takeaways
- GenieLocker is a custom multi-platform ransomware (Windows PE, Linux/ESXi ELF) active since March 2026, attributed to the financially motivated Toy Ghouls group (aka Bearlyfy, Labubu, Laboo.boo).
- The ransomware uses libsodium-based cryptography: XChaCha20-Poly1305 for file content encryption and Curve25519-XSalsa20-Poly1305 for key wrapping, with a hardcoded attacker master public key.
- Unlike most ransomware, GenieLocker does not drop ransom notes; attackers deliver demands manually, likely to evade detection of mass file creation events.
- The Windows variant includes anti-debugging (IsDebuggerPresent, CheckRemoteDebuggerPresent, CRC32 .text section integrity check, watchdog thread) and a secret hex argument required for execution, acting as a sandbox evasion mechanism.
- The ESXi/Linux variant targets /vmfs/volumes by default, modifies the ESXi Welcome Message, and supports daemonization via double-fork; its CLI output styling mirrors LockBit, suggesting GenieLocker was designed as a LockBit replacement.
Affected Systems
- Windows endpoints and servers
- Linux servers
- VMware ESXi hypervisors
- Organizations in the Russian Federation, primarily manufacturing, construction, financial services, retail, and technology sectors
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attackers entered via OpenVPN using stolen credentials from a trusted partner network.
- Discovery and Credential Access: Installed SoftPerfect Network Scanner for discovery; used Mimikatz for credential dumping; accessed KeePassXC databases on compromised hosts.
- Lateral Movement: Used RDP for Windows machines and SSH for Linux servers; deployed ransomware via PsExec and PAExec; established reverse SSH tunnel for C2.
- Impact (Windows): Deployed PE GenieLocker to encrypt files on Windows machines after killing database, office, and backup processes/services.
- Impact (ESXi/Linux): Deployed ELF GenieLocker to stop active VMs and encrypt disks on ESXi and Linux servers.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules (YARA, Sigma, Snort/Suricata, KQL, SPL, EQL) are provided in the article. Kaspersky product detection names are listed: Trojan-Ransom.Win64.Agent.genie, HEUR:TrojanRansom.Win64.Generic, Trojan-Ransom.Linux.Agent.genie. Additional IOCs and intelligence are available via Kaspersky Threat Intelligence Reporting service.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The ransomware terminates known processes and services before encryption, which EDR can detect. However, the use of legitimate tools (PsExec, PAExec, RDP, SSH, SoftPerfect Network Scanner) for lateral movement blends with admin activity. The secret argument and anti-debugging features complicate sandbox analysis but do not directly affect EDR telemetry on real endpoints. |
| Network Visibility | Medium | The reverse SSH tunnel to the C2 IP (89.125.66.101) is detectable via network flow analysis. OpenVPN connection from partner network is an indicator if baseline traffic patterns are known. However, lateral movement via RDP and SSH may appear as legitimate admin traffic. |
| Detection Difficulty | Moderate | The ransomware uses legitimate admin tools for deployment and standard cryptographic libraries, making purely signature-based detection insufficient. However, the mass process termination, service stopping, and rapid file extension changes provide strong behavioral signals. The absence of ransom notes removes one common detection trigger. |
Required Log Sources
- Windows Event Logs (Security: 4624, 4625, 4648, 4688)
- Sysmon Event ID 1 (Process Creation), 11 (File Creation), 13 (Registry Value Set)
- ESXi syslog and /var/log/vmware/ logs
- Network flow logs / firewall logs for SSH tunnel detection
- EDR process termination and service stop telemetry
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for processes named genie_encrypt.exe, kftd.exe, consultant.exe, tempo.exe, or vzdump executing with a hex string as the first argument, which may indicate GenieLocker execution with its secret argument. | EDR process creation events with command-line logging (Sysmon EID 1 or EDR equivalent) | Impact | Low — the combination of these filenames with a hex string first argument is highly unusual in normal operations. |
| Hunt for rapid sequential termination of database, backup, and office processes (sql, oracle, veeam, backup, excel, outlook, etc.) on a single host within a short time window, which matches GenieLocker's pre-encryption process killing behavior. | EDR process termination events, Windows Event Log 4688 with process termination | Impact | Medium — legitimate software deployment or patch management may cause similar but less aggressive process termination patterns. |
| Hunt for mass file rename or file creation events appending a long hex string extension (e.g., .03ffc1c4a3da0f02 or .4843c5aca9f93182) to existing files across multiple directories. | Sysmon EID 11 (File Creation), EDR file operation events, file integrity monitoring | Impact | Low — the specific hex-string extensions are not associated with legitimate software. |
| Hunt for outbound SSH connections from internal servers to external IPs that are not part of known admin infrastructure, which may indicate a reverse SSH tunnel used for C2. | Network flow logs, firewall logs, proxy logs | Command and Control | Medium — legitimate SSH access to external systems may exist in some environments. |
| Hunt for modifications to /etc/vmware/welcome on ESXi hosts, which GenieLocker modifies as part of its impact routine. | ESXi file integrity monitoring, ESXi syslog | Impact | Low — this file is rarely modified during normal ESXi operations. |
Control Gaps
- Signature-based AV may miss GenieLocker due to its custom nature and the absence of ransom note file creation, a common AV trigger.
- The use of legitimate admin tools (PsExec, PAExec, RDP, SSH) for lateral movement may bypass network-based controls if these tools are allowed in the environment.
- The secret hex argument requirement may prevent automated sandbox detonation, delaying analysis and detection rule development.
- Stopping backup services (Veeam, VSS) before encryption means backup-based recovery may fail if offline backups are not maintained.
Key Behavioral Indicators
- Process ancestry: PsExec or PAExec spawning genie_encrypt.exe or vzdump with a hex string argument
- Rapid sequential termination of database, backup, and office application processes via TerminateProcess
- Service stops issued for vss, sql, sophos, veeam, backup, msexchange, and related services via ControlService with SERVICE_CONTROL_STOP
- Mass file extension changes to long hex-string extensions (.03ffc1c4a3da0f02 or .4843c5aca9f93182)
- Creation of .lock and .journal files alongside encrypted files with VCJOURN magic bytes in journal content
- CRC32 integrity checking of the .text section by a watchdog thread every 500ms (anti-debugging behavior)
- ESXi welcome message file (/etc/vmware/welcome) being emptied or modified
- Reverse SSH tunnel to external IP 89.125.66.101
False Positive Assessment
Low — the specific hex-string file extensions, the combination of process names with hex secret arguments, and the rapid mass process/service termination pattern are highly distinctive and unlikely to occur in legitimate operations. However, the use of legitimate admin tools for lateral movement (PsExec, RDP, SSH) may generate false positives if these tools are commonly used in the environment.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking IP 89.125.66.101 at perimeter firewalls and proxy gateways if it is not associated with legitimate business traffic.
- Consider adding the provided MD5 hashes to your EDR or AV block lists and searching endpoints for matching samples.
- If your EDR supports it, consider creating behavioral detection rules for rapid sequential process termination of database, backup, and office applications followed by mass file modification events.
- Evaluate whether any current OpenVPN partner connections use credentials that may have been compromised; consider rotating VPN credentials for partner connections if suspicious activity is observed.
Infrastructure Hardening
- Consider implementing network segmentation to restrict lateral movement via RDP and SSH between workstation and server VLANs.
- Evaluate restricting PsExec and PAExec execution to specific admin workstations using application whitelisting or EDR policy controls.
- If running ESXi, consider enabling ESXi lockdown mode or restricting SSH access to ESXi hosts to a dedicated management network.
- Ensure offline or immutable backups are maintained and regularly tested, as GenieLocker actively stops backup services (Veeam, VSS) before encryption.
- Consider monitoring for and alerting on modifications to /etc/vmware/welcome on ESXi hosts.
User Protection
- Consider deploying EDR behavioral detections for the specific process names (genie_encrypt.exe, kftd.exe, consultant.exe, tempo.exe, vzdump) and their execution patterns.
- Evaluate enabling Sysmon logging for process creation (EID 1) with command-line capture to detect the secret hex argument pattern.
- Consider implementing file integrity monitoring on critical file shares to detect mass extension changes.
Security Awareness
- Consider reinforcing awareness training around credential hygiene, especially for VPN accounts shared with partner organizations.
- If applicable, remind users to report unexpected service outages or inability to open files, as these may indicate ransomware activity in progress.
- Consider reviewing access to KeePassXC password databases and evaluating whether credential vaults on shared workstations should be migrated to centralized privileged access management solutions.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Initial Access
Tactic
Stealth
Tactic
Credential Access
Tactic
Lateral Movement
Additional IOCs
- File Hashes:
F08F476F26B01D142CA73923DE65FC0C(MD5) - Windows GenieLocker sample.FD46A80C2F45577263328984EDF7F4DC(MD5) - Windows GenieLocker sample.DE3CFBB50F66079BFEE20A6F64E59433(MD5) - Windows GenieLocker sample.780C8F4C6F077DA4DA96582987920362(MD5) - Windows GenieLocker sample.D87D0B01D95ACC936B7DC47B8F41937A(MD5) - Windows GenieLocker sample (run.exe, genie_encrypt.exe).A8842616C9057D5CF6E1FE1FA8C3C160(MD5) - Windows GenieLocker sample.34B8828635F88078735799A3C1AC8E28(MD5) - Windows GenieLocker sample.D3E06EB34D8EEE7EF92CAC3AD0A20FF5(MD5) - Windows GenieLocker sample.9CD514FF2809CE0B993E3B8649E82A94(MD5) - Windows GenieLocker sample.824CA1E906CC073EE5B0F3519DF69A8F(MD5) - Windows GenieLocker sample.25480DAD40152EF3D0C6D38EECC9BD9B(MD5) - Windows GenieLocker sample.7DAD78584795AA5C160520CC6ACCF260(MD5) - Windows GenieLocker sample.18F61C6D686CFFD131C9FD3F3437064B(MD5) - Windows GenieLocker sample (tempo.exe, kernel.exe).9969A8221312DBA70DD5CBDDF83A146C(MD5) - Windows GenieLocker sample.F7B9E36E94163A9A303160945F99267A(MD5) - Windows GenieLocker sample.B893EAFED0659F70D4AC250F09073723(MD5) - Windows GenieLocker sample.D661CF666B9ACBAB7CFEAE1127A261A9(MD5) - Windows GenieLocker sample (genie.exe).3A4479B51890373BFC4A011EF41FE376(MD5) - Windows GenieLocker sample.58C0DDA52B8F069660166D61FD74F911(MD5) - Windows GenieLocker sample.
- File Paths:
/vmfs/volumes- Default target directory for the ESXi/Linux GenieLocker variant; ransomware recursively encrypts files under this path./etc/vmware/welcome- ESXi Welcome Message file modified by the Linux/ESXi GenieLocker variant; contents set to empty in observed sample.
- Command Lines:
- Purpose: Launch Windows GenieLocker with secret argument and target path; supports percentage-based partial encryption and recursive directory processing. | Tools:
genie_encrypt.exe| Stage: Impact |genie_encrypt.exe <hex_secret> -p <N> -r -l <logfile> <path> - Purpose: Launch ESXi/Linux GenieLocker with daemon mode, worker threads, and delay options targeting /vmfs/volumes. | Tools:
vzdump| Stage: Impact |vzdump -p <perc> -j <workers> -r <dir> -w <sec> -d -l <logfile>
- Purpose: Launch Windows GenieLocker with secret argument and target path; supports percentage-based partial encryption and recursive directory processing. | Tools:
- Other:
.03ffc1c4a3da0f02- File extension appended to encrypted files by the Windows GenieLocker variant; lock files use .03ffc1c4a3da0f02.lock and journal files use .03ffc1c4a3da0f02.journal..4843c5aca9f93182- File extension appended to encrypted files by the ESXi/Linux GenieLocker variant, observed in image metadata.