GenieLocker Ransomware Targets Windows, Linux, and ESXi Systems

Executive Summary

A financially motivated extortion group known as Toy Ghouls has deployed a custom ransomware family called GenieLocker against organizations in the Russian manufacturing sector since March 2026, according to a technical analysis published by Kaspersky researchers Fedor Sinitsyn and Yanis Zinchenko. The malware is notable for its cross-platform capabilities, with distinct builds for Windows (PE) and Linux/ESXi (ELF), and for its lack of a double-extortion model — the group does not exfiltrate data or operate a leak site.

Technical Analysis

GenieLocker represents a significant upgrade to Toy Ghouls' toolkit, which previously relied on third-party ransomware such as RedAlert, LockBit, and Babuk. The Windows variant (MD5: 5d62c1349b8981c396c9a23f4f8f053c) is written primarily in C and compiled with Microsoft Visual C/C++. It uses the open-source libsodium library for cryptographic operations. The malware supports command-line arguments including a mandatory "secret argument" — a hex string verified via SHA-256 hash — designed to thwart automated analysis and prevent unauthorized use by other threat actors.

Anti-debugging measures include calls to IsDebuggerPresent and CheckRemoteDebuggerPresent WinAPI functions. Notably, GenieLocker does not drop ransom notes on the victim's filesystem; instead, attackers deliver ransom demands manually during the attack, likely to avoid triggering detection based on the creation of multiple ransom note files.

The Linux and ESXi variant shares core encryption logic but is tailored for server environments. On ESXi systems, the ransomware stops active virtual machines before encrypting their disks. The encryption routine uses a percentage-based approach, configurable via the -p or --percent argument, allowing attackers to encrypt only a portion of file content to speed up the process.

Modus Operandi in a March 2026 Incident

Kaspersky documented an attack at the end of March 2026 where GenieLocker was deployed. Initial access was achieved through an OpenVPN connection originating from an external partner's network, using stolen but valid credentials — a trusted relationship compromise. Once inside, attackers installed OpenSSH, a SOCKS5 proxy (socks5.exe), SoftPerfect Network Scanner, and Mimikatz. They also accessed KeePassXC password manager databases already present on compromised machines.

Lateral movement relied on RDP for Windows systems and SSH for Linux servers. The ransomware was deployed at scale using the legitimate administrative tools PsExec and PAExec. A reverse SSH tunnel was established for command-and-control communication. Forensic analysis found no evidence of data exfiltration, consistent with Toy Ghouls' known operational pattern.

Mitigations & Recommendations

Defenders should monitor for the deployment of administrative tools like PsExec and PAExec in conjunction with network scanning utilities (SoftPerfect Network Scanner) and credential dumping tools (Mimikatz). Organizations should enforce strict access controls on VPN connections from partner networks, requiring multi-factor authentication and regular credential rotation. The use of a secret argument in GenieLocker suggests that sandbox-based detection may be evaded; behavioral monitoring for mass file encryption events and VM shutdown sequences on ESXi hosts is advised. No patch or vendor fix is applicable — this is a custom malware deployment, not a product vulnerability.