New GenieLocker Ransomware Attacks Windows, ESXi, and Linux Instances

GenieLocker, a newly identified ransomware linked to the financially motivated Toy Ghouls group, targets Windows, Linux, and VMware ESXi systems and has primarily attacked Russia’s manufacturing sector since March 2026. The Toy Ghouls group, also known as Bearlyfy, Labubu, and Laboo.boo, previously relied on ransomware families such as LockBit, Babuk, and RedAlert. The transition to GenieLocker reduces the group’s dependence on third-party malware, allowing for greater control over its ransomware operations. In a late-March intrusion, attackers reportedly gained initial access through an OpenVPN connection from an external partner network. They are believed to have used stolen but valid credentials, exploiting the trusted...

Les hele artikkelen hos kilden.