Bearlyfy Hits Russian Firms with Custom GenieLocker Ransomware

**Bearlyfy**, a pro‑Ukrainian threat actor, has been attributed with 70+ attacks on Russian companies since January 2025 and has recently been deploying a proprietary Windows ransomware called GenieLocker; attacks use exploitation of external services, MeshAgent for remote access, and favor rapid, high‑pressure extortion tactics with ransom demands reaching into the hundreds of thousands of dollars and an estimated ~20% victim payment rate.