[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f93gOurl37Mm6eYoXFgvv0UDrZ9DCmHjdzhLmovXHvSg":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"29c4724b-ee47-4133-be17-86bf9e096dbf","Toy Ghouls’ new toy: the GenieLocker ransomware","toy-ghouls-new-toy-the-genielocker-ransomware-216f90","Kaspersky experts dissect GenieLocker: new custom ransomware variants for Windows, Linux, and ESXi systems. We found this family in attacks by Toy Ghouls, a financially motivated extortion group.","Kaspersky experts have identified a new custom ransomware family named GenieLocker, active since March 2026. This ransomware, developed by the financially motivated Toy Ghouls group, targets Windows, Linux, and ESXi systems. The group previously used third-party ransomware but now employs this custom variant, which has been observed in attacks against organizations in the Russian Federation, primarily in the manufacturing sector.","New GenieLocker ransomware targets Windows, Linux, and ESXi, used by Toy Ghouls group.","https:\u002F\u002Fsecurelist.com\u002Fgenielocker-ransomware-for-windows-linux-and-esxi\u002F120843\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F07\u002F30070015\u002Fgenielocker-featured-image-scaled.jpg","2026-07-30T08:00:57+00:00","2026-07-30T10:00:17.025794+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Toy Ghouls","threat_actor",{"name":21,"type":22},"Kaspersky","vendor",{"name":24,"type":25},"Windows","product",{"name":27,"type":25},"Linux",{"name":29,"type":25},"ESXi","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"hash_md5","5d62c1349b8981c396c9a23f4f8f053c","GenieLocker for Windows sample",[21,24,27],{"controls":60,"vendors":144},[61,89,118],{"slug":62,"name":63,"problem":64,"products":65},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[66,74,81],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":62,"product_name":78,"url":79,"description":80},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":119,"name":120,"problem":121,"products":122},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[123,131,136],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":132,"product_name":133,"url":134,"description":135},"zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[145],{"slug":146,"name":147,"logo_path":148,"roles":149},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":167},"genielocker-ransomware-targets-windows-linux-and-esxi-systems","GenieLocker Ransomware Targets Windows, Linux, and ESXi Systems","The Toy Ghouls group has escalated their threat capability by developing a custom ransomware variant, GenieLocker, moving beyond reliance on third-party tools to a bespoke weapon targeting diverse operating environments including ESXi hypervisors. This shift signals a maturation of the threat actor and increases the risk of evasion against defenses tuned for known ransomware families. The targeting of manufacturing sector organizations highlights how operational technology-adjacent environments remain high-value ransomware targets. Organizations without robust, tested backups and segmented networks face significant recovery costs and operational downtime when custom ransomware bypasses signature-based detections.",[156,157,158,159,160,161,162,163,164,165,166],"CIS Control 10 – Malware Defenses","CIS Control 11 – Data Recovery","CIS Control 12 – Network Infrastructure Management","NIST SP 800-61 – Incident Response","NIST CP-9 – Information System Backup","NIST SC-7 – Boundary Protection","NIST SI-3 – Malicious Code Protection","MITRE ATT&CK T1486 – Data Encrypted for Impact","MITRE ATT&CK T1490 – Inhibit System Recovery","ISO\u002FIEC 27001 A.12.3 – Information Backup","ITIL Service Continuity Management",{}]