Loading story…
Researchers reported that the financially motivated Toy Ghouls group has deployed a new custom ransomware family, GenieLocker, against organizations in the Russian Federation, with manufacturing firms highlighted among the victims. Active since March 2026, the malware marks a shift away from third-party ransomware such as RedAlert, LockBit, and Babuk to a cross-platform encryptor built for Windows, Linux, and VMware ESXi environments.
In a documented intrusion, the attackers reportedly entered through an OpenVPN connection belonging to a trusted external partner by using stolen valid credentials, then expanded access with OpenSSH, SoftPerfect Network Scanner, Mimikatz, PsExec, and PAExec. The Windows variant uses anti-debugging protections, requires a secret launch argument, terminates processes and services, and encrypts data with libsodium implementations of XChaCha20-Poly1305 and Curve25519-XSalsa20-Poly1305, while the Linux/ESXi build includes ESXi-specific behavior such as modifying /etc/vmware/welcome and targeting /vmfs/volumes; researchers said the group typically focuses on encryption rather than data theft or leak-site extortion.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Gurucul released technical indicators for GenieLocker, including an IP address and MD5 hashes, along with example TDIR detection queries. The publication also described the ransomware's cross-platform targeting of Windows, Linux, and VMware ESXi environments and its use in attacks against Russia.
Kaspersky Securelist published a technical analysis of GenieLocker, attributing the ransomware family to the financially motivated Toy Ghouls group and describing it as the actor's first in-house encryptor. The report detailed Windows and Linux/ESXi variants, intrusion tradecraft, and noted no evidence of data exfiltration or a leak site.
In a March 2026 intrusion against an organization in the Russian Federation, attackers reportedly accessed the victim through an OpenVPN connection from a trusted external partner using stolen valid credentials. They then used tools including OpenSSH, SoftPerfect Network Scanner, Mimikatz, PsExec, and PAExec for discovery, credential access, lateral movement, and ransomware deployment.
Securelist reported that the GenieLocker ransomware family has been active since March 2026. It is described as a new cross-platform ransomware family targeting Windows, Linux, and ESXi systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyberveille.ch
Open sourcecommunity.gurucul.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026
Researchers reported that a ransomware group tracked as **Crypt Ghouls** targeted Russian businesses and government agencies across mining, energy, finance, retail, and public-sector organizations. The group reportedly gained initial access through compromised contractor VPN credentials, then established persistence with **NSSM** and **Localtonet**, harvested credentials using **XenAllPasswordPro** and **Mimikatz**, and expanded access with reconnaissance and lateral-movement tools including **PingCastle**, **SoftPerfect Network Scanner**, **WMI**, **Impacket** `WmiExec.py`, and **PAExec`. The attackers deployed **LockBit 3.0** on Windows systems and **Babuk** on Linux and **ESXi** environments, indicating a multi-platform ransomware capability. Researchers also found overlaps in tooling, infrastructure, and tactics with activity linked to **MorLock**, **BlackJack**, **Twelve**, and **Shedding Zmiy/(Ex)Cobalt**, suggesting collaboration, shared tooling, or intelligence exchange among multiple groups focused on Russian targets.
Jun 29, 2026
A newly identified ransomware operation known as **RedAlert**, also referenced internally as **N13V**, has been observed targeting corporate networks by encrypting both **Windows** systems and **Linux-based VMware ESXi** servers. The Linux variant is built specifically for ESXi environments and can forcibly shut down running virtual machines before encrypting VM-related files, while encrypted data is renamed with a `.crypt[number]` extension and accompanied by a `HOW_TO_RESTORE` ransom note containing a Tor payment link. Researchers reported that the malware uses the **NTRUEncrypt** public-key algorithm and already shows relatively mature cross-platform capabilities despite appearing to be a newer operation. RedAlert is also conducting **double-extortion** attacks, stealing data before encryption and threatening to publish it on a leak site if victims refuse to pay. Reporting on broader ransomware trends placed RedAlert alongside newer groups such as **0mega** and **Lilith**, underscoring a rise in emerging crews with increasingly capable tooling. In that wider landscape, RedAlert stood out for its focus on enterprise virtualization infrastructure, especially ESXi hosts, adding to concerns that ransomware operators are continuing to prioritize high-impact targets that can disrupt large numbers of systems at once.
Aug 15, 2026