GenieLocker — a Windows and ESXi ransomware built to leave no ransom note on disk, gated behind a hashed command-line secret so it will not run in a sandbox
Kaspersky published an analysis of GenieLocker on 2026-07-30, a ransomware family it dates to March 2026 and that open-source reporting attributes to the Toy Ghouls extortion group — also tracked as Bearlyfy, Labubu and Laboo.boo — which had previously relied on rented encryptors rather than its own (Kaspersky Securelist, 2026-07-30). The victim in the analysed intrusion was a Russian manufacturing organisation, which places the targeting outside this constituency; three deliberate design decisions in the malware are what transfer.
It will not run without a key the operator types. GenieLocker's Windows build expects its first command-line argument to be a hex string, which it converts to bytes, hashes with SHA-256, and compares against a value compiled into the binary. Without a match the process exits immediately. Kaspersky reads this as serving two purposes at once — evading sandboxes and automated analysis environments, which have no way to supply the argument, and preventing other criminals from reusing a captured sample. For a defender this has a concrete consequence: a sample recovered from an incident cannot be detonated to observe its behaviour unless the argument is also recovered, typically from command-line telemetry or shell history rather than from the file.
It watches for debuggers continuously, and for tampering with itself. Once the argument check passes, the malware spawns a thread that loops indefinitely, polling the standard debugger-presence checks every 500 milliseconds. On top of that it computes a checksum over its own executable code section at thread start and recomputes it on every iteration, so a breakpoint written into that section is detected as a change. Any single failed check terminates the whole process, with no partial-encryption fallback described.
It leaves nothing behind to alert on. GenieLocker writes no ransom note, carries no contact address and no negotiation link; the operators deliver demands by hand during the intrusion instead. Kaspersky's assessment of why is the operationally important part — that this is an attempt to avoid proactive detection triggered by the creation of multiple readme files. Any detection strategy that leans on mass note-drop as its ransomware trigger simply does not fire here. The ESXi build extends the same logic: it can overwrite the hypervisor's welcome message, and in the analysed sample that field was left blank rather than filled with a demand.
The intrusion around it is conventional and, for this constituency, the most familiar part. Initial access came over an OpenVPN connection originating from an external partner's network, using stolen credentials that were still valid — Kaspersky's assessment is that the operators exploited the trusted relationship with that partner rather than breaching the victim's own perimeter. From there they ran SoftPerfect Network Scanner for discovery, dumped credentials with Mimikatz, and accessed the KeePassXC password manager already installed on several machines to try to extract what was stored in its databases. Lateral movement used RDP to Windows hosts and SSH to Linux servers, mass deployment of the encryptor was carried out with the legitimate PsExec and PAExec utilities, and command-and-control ran over a reverse SSH tunnel. On the Linux and ESXi side the operators stopped running virtual machines before encrypting their disks. Kaspersky found no evidence of data exfiltration and notes this group runs neither double extortion nor a leak site — which means, unusually, that the encryption event is the whole extortion.
Detection. Because the note is gone, the durable behavioural triggers are the ones around it: a rapid rise in file-modification volume with high-entropy writes across shares, and, on hypervisors, virtual machines being powered off in sequence shortly before their backing datastore files start changing — that ordering is the ESXi ransomware signature that does not depend on any note or binary. On the endpoint, remote service creation by PsExec-class tooling from a host that is not a management server is the deployment step, and it is loud in service-creation and process-creation telemetry. Two collection behaviours are worth hunting independently of this family: a process other than the password manager itself opening a KeePass database file, and any read of a credential database from a service account context.
Triage: administrators use PsExec, and virtual machines are shut down for maintenance every day. The discriminators are direction and breadth — legitimate PsExec runs originate from a known management host to a bounded set of targets, whereas deployment here fans out from a recently-compromised workstation to everything reachable; and maintenance shutdowns are scheduled, announced in change records, and followed by boots rather than by datastore writes. For the password-manager signal the discriminator is the accessing process: the user's own manager opening its database is normal, a scripted or remote-execution parent doing it is not.
During the incident, the attackers first entered the environment through an OpenVPN connection originating from an external partner's network. They likely exploited the trusted relationship with that partner and used stolen, yet still valid, credentials to connect.
GenieLocker starts a new parallel thread called watchdog. It runs in an infinite loop that performs a number of checks to detect well-known debuggers every 500 milliseconds. If at least one of the checks fails, the whole GenieLocker process immediately terminates.
GenieLocker doesn't save the ransom notes on the victim's system. The Trojan doesn't contain any attackers' contact info or negotiation addresses. Instead, the attackers will need to deliver the ransom demands and contacts manually during the attack.
ATT&CK mapping
13 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1199Trusted Relationship
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Execution TA0002
T1569.002System Services: Service Execution
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and Net.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1622Debugger Evasion
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.
Credential Access TA0006
T1003.001OS Credential Dumping: LSASS Memory
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
T1555.005Credentials from Password Stores: Password Managers
Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.
Discovery TA0007
T1046Network Service Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.
T1622Debugger Evasion
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.
Lateral Movement TA0008
T1021.001Remote Services: Remote Desktop Protocol
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
T1021.004Remote Services: SSH
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.
T1570Lateral Tool Transfer
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.
Command and Control TA0011
T1572Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
Impact TA0040
T1486Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
T1489Service Stop
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.