Bearlyfy Group Deploys Custom GenieLocker Ransomware Campaign

Since March 2026, the threat group known as Bearlyfy (also identified as Toy Ghouls or Labubu) has significantly escalated its operations by deploying custom ransomware dubbed GenieLocker. Historically reliant on leaked builders like LockBit 3.0 and Babuk, the group's transition to a self-developed, multi-platform encryptor indicates a higher level of technical maturity and a desire to reduce dependency on third-party software. The group operates with a dual motivation of financial gain and sabotage, frequently collaborating with other pro-Ukrainian entities like Head Mare.

The attack chain typically involves compromising third-party trust relationships or exploiting public-facing services (e.g., Bitrix, 1C). Once inside, the actors utilize extensive tunneling tools and native utilities to move laterally and escalate privileges before deploying GenieLocker. Technical analysis reveals sophisticated anti-debugging features and a modular encryption scheme inspired by the Venus/Trinity families. The campaign has primarily impacted the Russian manufacturing, construction, and financial sectors, with approximately 20% of victims reportedly paying the ransom demands.