GENIELOCKER ransomware has struck manufacturing companies across Russia, encrypting Windows Linux and VMware ESXi systems after attackers bought access with stolen VPN credentials according to security researchers.
The attacks began appearing in late July and continued into early August, affecting multiple factories that rely on continuous production lines.
The ransomware builds separate binaries for each platform, with the Windows variant employing the libsodium library for encryption and packing anti‑debugging tricks to hinder analysis.
Linux and ESXi versions are simpler but still capable of traversing shared storage and encrypting virtual machine disks.
Initial access is gained by reusing OpenVPN credentials harvested from earlier breaches, allowing the threat actors to log in directly to perimeter devices.
Once inside, they use native RDP and SSH utilities for lateral movement, querying Active Directory and scanning for file servers before launching the encryptor.
Toy Ghouls, the group tracked behind GenieLocker, has been active since March 2026 and previously relied on ransomware‑as‑a‑service offerings before developing this custom toolkit.
Kaspersky’s analysis of the new encryptor is available online and notes that the shift to a home‑grown encryptor marks a significant increase in the group’s capability, particularly against Russian industrial targets.
Telemetry from multiple victims shows the ransomware was active between 30 July and 5 August 2026, with ransom demands delivered through chat channels after the encryption routine finished.
Victims reported that no ransom note was dropped on disk, forcing them to rely on attacker communication to learn the payment details.
Defenders should enforce multi‑factor authentication on all VPN portals and rotate any credentials that may have been exposed in earlier leaks.
Network segmentation that isolates production OT from corporate IT limits the spread of RDP or SSH sessions used by the attackers.
Maintaining offline, immutable backups of critical files ensures recovery without paying the ransom, while monitoring for unusual libsodium calls can flag the encryptor before it finishes.
Updating endpoint detection rules to look for the specific OpenVPN login patterns and for the use of native RDP/SSH tools in atypical contexts improves early warning.
Sharing indicators of compromise with industry ISACs and applying the latest patches to VPN appliances further reduces the attack surface.