Toy Ghouls’ new toy: the GenieLocker ransomware

This report documents GenieLocker, a newly observed cross-platform ransomware family used by the Toy Ghouls extortion group since March 2026; it analyzes Windows, Linux and ESXi builds, deployment TTPs (credential-based OpenVPN access, discovery and credential theft with Mimikatz and KeePassXC access, lateral movement via RDP/SSH, deployment via PsExec/PAExec and reverse SSH), encryption internals (per-file XChaCha20-Poly1305 with Curve25519 key wrapping), anti-debugging and exclusion lists, observed impact on Russian manufacturing and other sectors, and provides indicators of compromise including hashes, filenames and a C2 IP.