Toy Ghouls’ new toy: the GenieLocker ransomware

The Toy Ghouls group, also known as Bearlyfy, Labubu, and Laboo.boo, has released GenieLocker, a custom ransomware family targeting organizations in Russia, primarily in the manufacturing sector. This new ransomware is a significant upgrade from the group's previous reliance on third-party encryption Trojans and offers native support for Windows, Linux, and ESXi. GenieLocker employs advanced techniques like anti-debugging, a secret argument for preventing execution in sandboxes, and a sophisticated encryption scheme utilizing XChaCha20-Poly1305 and Curve25519-XSalsa20-Poly1305. The group’s tactics align with those of LockBit, suggesting a deliberate effort to create a bespoke ransomware solution. Notably, the campaign is heavily concentrated in Russia, with manufacturing being the primary target sector.