GENESIS Ransomware Gang: 9 New Listings Posted — Sector Targeting Analysis & Detection Rules | Security Arsenal

Classification: TLP:CLEAR | Publication Date: 2026-11-01 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

Executive Summary

On 30 October 2026, the ransomware-as-a-service (RaaS) operator known as GENESIS published claims listing nine organizations on its dark web leak site. The listings span Financial Services, Professional Services, Healthcare, and Manufacturing sectors, with a geographic concentration in the United States and Canada.

All nine listings were independently observed by a second leak-site crawler (multi-source), confirming that GENESIS published these claims; however, none of the named organizations have confirmed a breach. The group’s current campaign appears to target mid-market enterprises and leverages a double-extortion model consistent with its historical operations. Security teams in the affected verticals should review the detection engineering and incident response priorities outlined below.

Sourcing & Verification

This briefing is based on live data collected from the GENESIS dark web leak site via ransomware.live.

Corroboration: 9 of 9 listings were independently observed by a second leak-site crawler (multi-source). Zero listings appear on a single source only.
Nature of Claims: Inclusion in this briefing reflects the threat actor’s claim and is not confirmation of a breach. No tier in this data confirms that a named organization was compromised.
Disputes: A named organization may dispute the listing. A denial is likewise not proof that the claim is false; disclosure obligations vary by jurisdiction, and not every incident is reportable. Neither silence nor denial settles the question of compromise.
Corrections: Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — GENESIS

Known Aliases: Genesis, GenesisLocker

Operational Model: GENESIS operates as a closed Ransomware-as-a-Service (RaaS) model with a limited affiliate pool. Unlike high-volume RaaS programs, GENESIS appears to prioritize mid-market targets in professional services and critical infrastructure-adjacent sectors, suggesting a vetting process for affiliates or centralized operations.

Ransom Demands: Typical initial demands range from $250,000 to $1.5 million USD, with payment demanded in Monero or Bitcoin. The group employs a tiered pricing structure based on victim revenue and perceived ability to pay, often reducing demands upon early contact.

Initial Access Methods:

External Service Exploitation: Historical TTPs indicate heavy reliance on exploiting unpatched perimeter devices (VPN concentrators, firewall management interfaces) and exposed remote services.
Phishing: Targeted spear-phishing campaigns delivering malicious Office documents with macro-enabled payloads or ISO/LNK containers.
RDP Brute Force: Credential stuffing and brute-force attacks against internet-facing RDP, particularly targeting managed service providers (MSPs) and professional services firms.
Supply Chain/Third-Party: Evidence suggests opportunistic exploitation of vulnerable managed file transfer (MFT) solutions and MSP toolsets.

Extortion Model: GENESIS operates a double-extortion model. Prior to encryption, affiliates exfiltrate sensitive data (financial records, personally identifiable information, intellectual property) to attacker-controlled infrastructure. Victims face both operational disruption from encryption and reputational/regulatory damage from data publication on the leak site.

Dwell Time: Observed average dwell time before detonation is 5 to 12 days, with rapid lateral movement in the initial 48 hours followed by data staging in the final 72 hours.

Current Campaign Analysis

Targeted Sectors

The 30 October 2026 batch of listings indicates a diverse sectoral focus:

Professional Services (4 organizations): Legal, consulting, and engineering firms
Financial Services (1 organization): Investment and real estate holdings
Healthcare (1 organization): Work injury resource centers and medical services
Manufacturing (2 organizations): Construction and industrial engineering
Not Found (1 organization): Sector classification unavailable

Geographic Concentration

United States: 8 of 9 listings
Canada: 1 of 9 listings (Psychometrics Canada)

This aligns with GENESIS’s historical focus on North American mid-market enterprises with mature cyber insurance coverage but potentially under-resourced security operations.

Victim Profile

Based on the listed organizations, GENESIS is targeting mid-market enterprises with estimated annual revenues ranging from $10 million to $250 million USD. The selection of professional services firms (legal, accounting, engineering) suggests a focus on organizations holding sensitive client data—valuable for extortion but often with less mature security controls than large enterprises.

Posting Frequency & Escalation

All nine listings were published on 2026-10-30, representing a concentrated batch release. This "burst" pattern is consistent with GENESIS’s historical behavior of listing multiple victims simultaneously to maximize pressure and media attention. The group typically maintains a 7-14 day interval between batches, though this can accelerate during periods of successful affiliate operations.

CVE Exposure Hypothesis

While there is no evidence linking specific CVEs to the initial access of the named victims listed above, GENESIS has historically exploited vulnerabilities in perimeter devices and management interfaces. Security teams should prioritize patching the following CISA KEV vulnerabilities associated with ransomware operations in sector-level risk assessments:

CVE-2026-59310 (VMware vCenter Path Traversal): Potential for lateral movement within virtualized environments common in professional services.
CVE-2026-50751 (Check Point Security Gateway Improper Authentication): Risk of unauthorized VPN access.
CVE-2026-20316 (Cisco Secure FMC Hard-coded Password): Exposure of firewall management planes.
CVE-2026-63077 (JetBrains TeamCity Deserialization): Supply chain and development infrastructure risks.
CVE-2026-48027 (Nx Console Embedded Malicious Code): Development environment compromise leading to downstream access.

Note: These are sector-level exposure considerations, not confirmed attack vectors for the named organizations.

Detection Engineering

SIGMA Rules

YAML

---
title: Suspicious PsExec Service Execution — GENESIS Lateral Movement
description: Detects execution of PsExec-style service creation and execution patterns consistent with GENESIS ransomware affiliate lateral movement techniques
references:
    - https://attack.mitre.org/techniques/T1569/002/
    - https://attack.mitre.org/techniques/T1021/002/
author: Security Arsenal
date: 2026/11/01
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\PSEXESVC.exe'
        CommandLine|contains|all:
            - '\\'
            - '-s'
            - '-d'
    condition: selection
falsepositives:
    - Legitimate administrative PsExec usage
level: high
tags:
    - attack.lateral_movement
    - attack.t1569.002
    - attack.t1021.002

---
title: GENESIS Ransomware — WMI Process Call Create for Remote Execution
description: Detects WMI-based remote process execution patterns used by GENESIS operators for lateral movement and payload deployment
references:
    - https://attack.mitre.org/techniques/T1047/
author: Security Arsenal
date: 2026/11/01
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wmic.exe'
        CommandLine|contains:
            - 'process call create'
            - 'powershell'
            - 'cmd'
    condition: selection
falsepositives:
    - Legitimate administrative WMI usage
level: high
tags:
    - attack.lateral_movement
    - attack.t1047

---
title: GENESIS RDP Brute Force Detection — Multiple Failed Logins
description: Detects potential RDP brute-force activity consistent with GENESIS initial access methods targeting exposed remote services
references:
    - https://attack.mitre.org/techniques/T1110/
    - https://attack.mitre.org/techniques/T1133/
author: Security Arsenal
date: 2026/11/01
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
        Logon_Type: 3
        Workstation_Name|contains:
            - 'DESKTOP-'
            - 'WIN-'
    condition: selection | count() > 10
falsepositives:
    - Legitimate password spraying attempts
    - Vulnerability scanning
level: medium
tags:
    - attack.credential_access
    - attack.t1110
    - attack.t1133

KQL (Microsoft Sentinel) — Lateral Movement & Pre-Ransomware Staging

KQL — Microsoft Sentinel / Defender

// Hunt for GENESIS pre-ransomware staging and lateral movement indicators
// Focus: PsExec, WMI, and suspicious service creation in 24h window
let timeframe = 24h;
let suspicious_hosts = (SecurityEvent
    | where TimeGenerated > ago(timeframe)
    | where EventID == 4625 and LogonType == 3
    | summarize FailedAttempts = count() by Computer, IpAddress
    | where FailedAttempts > 20
    | project Computer);
SecurityEvent
| where TimeGenerated > ago(timeframe)
| where EventID in (7045, 4697)  // Service creation
| where Computer in (suspicious_hosts) or Computer in (suspicious_hosts)
| where ServiceName contains "PSEXESVC" or ServiceName contains "admin" or ServiceFileName contains "powershell"
| project TimeGenerated, Computer, Account, ServiceName, ServiceFileName, IpAddress
| join kind=inner (SecurityEvent
    | where TimeGenerated > ago(timeframe)
    | where EventID == 4688
    | where Process has "wmic.exe" and CommandLine has "process call create"
    | project TimeGenerated, Computer, CommandLine) on Computer
| project TimeGenerated, Computer, Account, ServiceName, ServiceFileName, CommandLine, IpAddress
| order by TimeGenerated desc

PowerShell — Rapid Response Hardening & Detection

PowerShell

<#
.SYNOPSIS
    GENESIS Ransomware Rapid Response Script
.DESCRIPTION
    Checks for exposed RDP, recent scheduled tasks, and Volume Shadow Copy tampering
    consistent with GENESIS TTPs.
.NOTES
    Run with Administrative privileges
#>

Write-Host "=== GENESIS Threat Hunt — $(Get-Date) ===" -ForegroundColor Cyan

# 1. Check for exposed RDP (listening on 3389 with NLA disabled or weak config)
Write-Host "`n[*] Checking RDP Configuration..." -ForegroundColor Yellow
$RDPStatus = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
$NLAStatus = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -ErrorAction SilentlyContinue

if ($RDPStatus.fDenyTSConnections -eq 0) {
    Write-Host "[ALERT] RDP is ENABLED." -ForegroundColor Red
    if ($NLAStatus.UserAuthentication -eq 0) {
        Write-Host "[CRITICAL] Network Level Authentication (NLA) is DISABLED. Immediate risk of brute force." -ForegroundColor Red
    } else {
        Write-Host "[INFO] NLA is enabled." -ForegroundColor Green
    }
    # Check for recent RDP logons
    $RDPLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; LogonType=10} -MaxEvents 10 -ErrorAction SilentlyContinue | 
        Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}, @{N='SourceIP';E={$_.Properties[18].Value}}
    if ($RDPLogons) {
        Write-Host "[INFO] Recent RDP Logons detected:" -ForegroundColor Yellow
        $RDPLogons | Format-Table -AutoSize
    }
} else {
    Write-Host "[OK] RDP is disabled." -ForegroundColor Green
}

# 2. Enumerate scheduled tasks created in last 7 days
Write-Host "`n[*] Checking for suspicious scheduled tasks (last 7 days)..." -ForegroundColor Yellow
$SuspiciousTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | 
    Where-Object {$_.TaskPath -notlike "*Microsoft*" -and $_.TaskName -notlike "*Windows*"}

if ($SuspiciousTasks) {
    Write-Host "[ALERT] Recent non-Microsoft scheduled tasks found:" -ForegroundColor Red
    $SuspiciousTasks | Select-Object TaskName, TaskPath, Date, Author | Format-Table -AutoSize
} else {
    Write-Host "[OK] No suspicious recent scheduled tasks found." -ForegroundColor Green
}

# 3. Check Volume Shadow Copies (VSS)
Write-Host "`n[*] Checking Volume Shadow Copy integrity..." -ForegroundColor Yellow
$VSS = Get-WmiObject -List Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($VSS) {
    $ShadowCount = (vssadmin list shadows 2>&1 | Select-String "Shadow Copy ID").Count
    Write-Host "[INFO] $ShadowCount shadow copies found." -ForegroundColor Green
    if ($ShadowCount -eq 0) {
        Write-Host "[ALERT] No shadow copies found. VSS may have been tampered with (common ransomware behavior)." -ForegroundColor Red
    }
} else {
    Write-Host "[ALERT] Unable to query VSS or no shadow copies present." -ForegroundColor Red
}

# 4. Check for common GENESIS persistence locations
Write-Host "`n[*] Checking for persistence in common locations..." -ForegroundColor Yellow
$PersistencePaths = @(
    "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
    "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
)
foreach ($path in $PersistencePaths) {
    $Items = Get-ChildItem -Path $path -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)}
    if ($Items) {
        Write-Host "[ALERT] Recent items in $path :" -ForegroundColor Red
        $Items | Select-Object Name, LastWriteTime | Format-Table -AutoSize
    }
}

Write-Host "`n=== Hunt Complete ===" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption)

If GENESIS is active in your environment, you may have 5-12 days before encryption. Watch for:

Initial Access Indicators:
- Unexpected VPN or RDP authentication from external IPs, particularly after-hours
- Successful logins following multiple failed attempts (brute force patterns)
- Web shell deployment on perimeter devices or DMZ servers
Lateral Movement:
- PsExec-style service creation (Event ID 7045 with service names like PSEXESVC)
- WMI process creation (wmic.exe with "process call create")
- Suspicious RDP connections between internal workstations
Data Staging:
- Large outbound data transfers ( >1GB) to cloud storage (MEGA, Dropbox, file.io)
- Compression utilities (7z, rar) executing on file servers or databases
- Access to backup repositories or Veeam/Commvault consoles
Defense Evasion:
- Volume Shadow Copy deletion (vssadmin delete shadows)
- Clearing of Windows Event Logs (Event ID 1102)
- Disabling of security tools via service termination

Critical Exfiltration Targets

GENESIS historically prioritizes:

Financial Records: QuickBooks files, banking credentials, tax documents
Legal/Client Data: Case files, contracts, privileged communications (particularly from professional services firms)
Healthcare Records: Patient PII, medical histories, insurance information
Intellectual Property: Engineering schematics, manufacturing process documentation

Containment Actions (Ordered by Urgency)

Immediate (0-1 hour):
- Isolate affected segments from the network
- Block all outbound traffic to known GENESIS C2 infrastructure and bulletproof hosting providers
- Disable compromised accounts identified in lateral movement detection
Short-term (1-4 hours):
- Force password resets for all privileged accounts
- Review and disable any unauthorized scheduled tasks or services
- Enable firewall blocks for outbound SMB (445) and RDP (3389) from server VLANs
Medium-term (4-24 hours):
- Deploy network segmentation to isolate critical servers
- Verify integrity of backups (ensure they are offline and immutable)
- Preserve forensic images of affected systems before remediation

Hardening Recommendations

Immediate (24 Hours)

Patch KEV Vulnerabilities: Immediately apply patches for CVE-2026-59310 (VMware vCenter), CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), and CVE-2026-63077 (JetBrains TeamCity) if present in your environment.
Disable NLA-less RDP: Enforce Network Level Authentication (NLA) on all RDP endpoints or disable RDP if not required.
Enable LAPS: Ensure Local Administrator Password Solution (LAPS) is deployed to prevent lateral movement via shared local admin credentials.
Block PsExec: Restrict PsExec execution via AppLocker or WDAC policies; monitor for PSEXESVC service creation.
Review VPN Logs: Audit VPN and remote access logs for brute-force patterns and anomalous geographic logins.

Short-Term (2 Weeks)

Network Segmentation: Implement micro-segmentation to isolate critical servers (file, database, backup) from general user workstations.
EDR Tuning: Ensure EDR solutions are configured to detect WMI process creation and Cobalt Strike beaconing patterns (if not blocked outright).
Backup Hardening: Implement immutable, air-gapped, or offline backup solutions; test restoration procedures.
Phishing Resistance: Deploy FIDO2 hardware keys for administrative access and enable Office 365 Attack Surface Reduction (ASR) rules to block macro execution from internet zones.
Threat Hunting: Deploy the Sigma and KQL rules provided in this briefing to your SIEM and begin hunting for historical indicators.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

GENESIS Ransomware Gang: 9 New Listings Posted — Sector Targeting Analysis & Detection Rules