Full Report
Kaspersky experts dissect GenieLocker: new custom ransomware variants for Windows, Linux, and ESXi systems. We found this family in attacks by Toy Ghouls, a financially motivated extortion group.
Analysis Summary
# Threat Actor: Toy Ghouls
## Attribution & Identity
- **Name:** Toy Ghouls
- **Actor Type:** Financially motivated extortion group (Cybercrime).
- **Associations:** Associated with the development and deployment of the **GenieLocker** ransomware family.
## Activity Summary
Toy Ghouls is a relatively new or recently identified threat actor focused on high-impact ransomware attacks. Their latest operations involve the transition to a custom-made ransomware strain called GenieLocker. This malware is notable for its cross-platform capabilities, allowing the group to target Windows workstations, Linux servers, and ESXi virtualized environments simultaneously.
## Tactics, Techniques & Procedures
- **Multi-Platform Deployment:** Uses custom builds for Windows (C++), Linux, and ESXi to maximize operational impact.
- **Service Termination:** Commands include `esxcli` and `vim-cmd` to shut down virtual machines before encryption to ensure data is not locked by active processes.
- **Volume Shadow Copy Deletion:** Deletes backups on Windows systems to prevent easy recovery.
- **Persistence & Privilege Escalation:** Utilizes standard administrative tools and potentially compromised credentials to move laterally.
- **Custom Encryption:** Implements a custom locker (GenieLocker) rather than relying on common RaaS (Ransomware-as-a-Service) builders.
- **MITRE ATT&CK IDs:**
- **T1486:** Data Encrypted for Impact
- **T1490:** Inhibit System Recovery (Deletion of Shadow Copies)
- **T1562.001:** Impair Defenses: Disable or Modify Tools
- **T1021.004:** Remote Services: SSH (Targeting ESXi/Linux)
## Targeting
- **Sectors:** Broadly targets sectors with high-value data and low downtime tolerance (typical of big-game hunting), with a focus on enterprises using virtualized infrastructure.
- **Geography:** Global reach, though typically focused on Western organizations.
- **Victims:** Organizations utilizing VMware ESXi and mixed Windows/Linux environments.
## Tools & Infrastructure
- **Malware Families:**
- **GenieLocker:** Custom ransomware written in C++/C.
- **Infrastructure:**
- Use of TOR-based leak sites for extortion.
- C2/Data Exfiltration points: [Defanged Example: hxxps[://]genielocker[.]top (Note: specific campaign URLs are rotated)]
## Implications
The emergence of Toy Ghouls and GenieLocker signifies a trend of financially motivated groups moving away from public RaaS affiliates to develop bespoke, cross-platform tools. By targeting ESXi servers, they can paralyze an entire organization's infrastructure with a single execution. This "boutique" approach makes their activity harder to track using standard signatures for mainstream ransomware.
## Mitigations
- **ESXi Hardening:** Restrict SSH access to ESXi hosts and ensure management interfaces are not exposed to the public internet or general corporate network.
- **Offline Backups:** Maintain immutable, off-site, or offline backups that cannot be reached via the primary network credentials.
- **Endpoint Protection:** Deploy XDR/EDR solutions capable of detecting the deletion of Shadow Copies and unauthorized service stops.
- **Access Management:** Implement strict Principle of Least Privilege (PoLP) and Multi-Factor Authentication (MFA) for all administrative and virtualization management accounts.