THREAT OPS › Threat News › Toy Ghouls’ new toy: the GenieLocker ransomware
Toy Ghouls’ new toy: the GenieLocker ransomware
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/07/30070015/genielocker-featured-image-990x400.jpg" width="990" /></p><h2 id="introduction">Introduction</h2> <p>The new GenieLocker ransomware family has been active since March 2026. It has been used in attacks a
MITRE ATT&CK techniques
Indicators of compromise
- 5d62c1349b8981c396c9a23f4f8f053cmd5
- 9201e35e2993612612919a3c71302cabmd5
- a50eaaf514f4f84e61ca2455a8789753md5
- f08f476f26b01d142ca73923de65fc0cmd5
- fd46a80c2f45577263328984edf7f4dcmd5
- de3cfbb50f66079bfee20a6f64e59433md5
- 780c8f4c6f077da4da96582987920362md5
- d87d0b01d95acc936b7dc47b8f41937amd5
- 34a7f28e0bb69b0d49bacc88bdf20ac1md5
- a8842616c9057d5cf6e1fe1fa8c3c160md5
- 34b8828635f88078735799a3c1ac8e28md5
- d3e06eb34d8eee7ef92cac3ad0a20ff5md5
- c68b6862725777651085650db34947fcmd5
- 9cd514ff2809ce0b993e3b8649e82a94md5
- 824ca1e906cc073ee5b0f3519df69a8fmd5
- 25480dad40152ef3d0c6d38eecc9bd9bmd5
- 7dad78584795aa5c160520cc6accf260md5
- 18f61c6d686cffd131c9fd3f3437064bmd5
- 9969a8221312dba70dd5cbddf83a146cmd5
- f7b9e36e94163a9a303160945f99267amd5
- b893eafed0659f70d4ac250f09073723md5
- d661cf666b9acbab7cfeae1127a261a9md5
- 3a4479b51890373bfc4a011ef41fe376md5
- 58c0dda52b8f069660166d61fd74f911md5
- https://www.securitylab.ru/blog/company/F6/360061.phpurl
- https://securelist.ru/tr/toy-ghouls/115909/url
- https://www.kaspersky.com/enterprise-security/threat-intelligence-reporting?icid=gl_sl_post-link-tip-reports_sm-team_54d4bf9ad05581e5url
- https://opentip.kaspersky.com/a50eaaf514f4f84e61ca2455a8789753/results?icid=gl_sl_post-opentip_sm-team_3298a9dab8ebd00f&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/f08f476f26b01d142ca73923de65fc0c/results?icid=gl_sl_post-opentip_sm-team_c36e325d3425a0d3&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/fd46a80c2f45577263328984edf7f4dc/results?icid=gl_sl_post-opentip_sm-team_55c60db8275c1d83&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/de3cfbb50f66079bfee20a6f64e59433/results?icid=gl_sl_post-opentip_sm-team_ef75946d34371f4e&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/780c8f4c6f077da4da96582987920362/results?icid=gl_sl_post-opentip_sm-team_963c0e5fb3ed18b1&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/d87d0b01d95acc936b7dc47b8f41937a/results?icid=gl_sl_post-opentip_sm-team_e3881df55a46b82f&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/34a7f28e0bb69b0d49bacc88bdf20ac1/results?icid=gl_sl_post-opentip_sm-team_76a1ed3d219e8793&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/5d62c1349b8981c396c9a23f4f8f053c/results?icid=gl_sl_post-opentip_sm-team_820c7143a27600c3&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/a8842616c9057d5cf6e1fe1fa8c3c160/results?icid=gl_sl_post-opentip_sm-team_20e7e75244b19af8&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/34b8828635f88078735799a3c1ac8e28/results?icid=gl_sl_post-opentip_sm-team_18af55e0d4818dba&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/d3e06eb34d8eee7ef92cac3ad0a20ff5/results?icid=gl_sl_post-opentip_sm-team_58d06dfce9465bac&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/c68b6862725777651085650db34947fc/results?icid=gl_sl_post-opentip_sm-team_164332924608387e&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/9cd514ff2809ce0b993e3b8649e82a94/results?icid=gl_sl_post-opentip_sm-team_420cab2ef1c6e6dd&utm_source=SL&utm_medium=SL&utm_campaign=SLurl