Campaign Overview

The group, also tracked as "Labubu" by some security vendors, has demonstrated a dual-purpose operational model combining financial extortion with destructive sabotage. Their latest campaigns leverage a custom ransomware strain dubbed "GenieLocker," first observed in late February 2026.

Unlike commodity ransomware, GenieLocker employs a hybrid encryption scheme combining ChaCha20 for file encryption with RSA-4096 for key protection. The malware features anti-analysis techniques including VM detection, debugger evasion, and process hollowing.

# GenieLocker encryption routine (pseudocode) def encrypt_file(path): key = generate_chacha20_key() nonce = os.urandom(12) with open(path, 'rb') as f: data = f.read() cipher = ChaCha20(key, nonce) encrypted = cipher.encrypt(data) # RSA-4096 wrap the symmetric key wrapped_key = rsa_encrypt(pub_key, key) return wrapped_key + nonce + encrypted

Initial Access Vectors

Bearlyfy operators have demonstrated proficiency with multiple initial access techniques:

  • Spearphishing — Weaponized documents exploiting CVE-2024-38213 (Windows SmartScreen bypass)
  • Exposed RDP — Brute-force attacks against internet-facing Remote Desktop services
  • Supply Chain — Trojanized updates via compromised Russian software vendors

Post-compromise, the group establishes persistence using scheduled tasks and WMI event subscriptions before deploying Cobalt Strike beacons for lateral movement.

Victim Profile

Analysis reveals a focus on mid-sized Russian enterprises, particularly in manufacturing, logistics, and financial services. Ransom demands have escalated from ~€30,000 in early operations to over €80,000 in recent campaigns.

Attribution

While definitive attribution remains challenging, multiple indicators suggest Ukrainian origins: operational timing aligned with Ukrainian business hours, Ukrainian-language strings in early samples, and explicit pro-Ukrainian messaging in ransom notes.

Defensive Recommendations

  1. Implement application allowlisting to prevent unauthorized executables
  2. Disable or restrict RDP access, require VPN for remote administration
  3. Deploy EDR with ransomware-specific behavioral detection
  4. Maintain offline, immutable backups tested for restoration
MITRE ATT&CK: T1566.001 • T1059.001 • T1486 • T1021.001 • T1082