Current OTX pulses indicate a surge in distinct, high-impact cyber campaigns targeting critical industrial sectors. The first campaign involves a sophisticated credential theft operation utilizing a "RedLine Thread" to pivot into a broader Business Email Compromise (BEC) infrastructure targeting the South Korean maritime industry. This cluster leverages multiple infostealer families, including RedLine, Formbook, and Metamorfo, distributed via typosquatting domains impersonating major entities (e.g., amdocsllc.shop).
Simultaneously, the threat actor group "Toy Ghouls" (aka Bearlyfy) has emerged with a new custom ransomware family, GenieLocker. Moving away from third-party builders like LockBit and Babuk, Toy Ghouls is actively targeting the manufacturing and construction sectors within the Russian Federation. GenieLocker exhibits advanced capabilities including ESXi encryption and the utilization of Mimikatz for credential dumping, suggesting a dual focus on data encryption and lateral movement.
Threat Actor / Malware Profile
RedLine Stealer & Associated Infostealers
- Malware Families: RedLine Stealer (S1240), XLoader (S1207), Formbook, Metamorfo (S0455), Casbaneiro.
- Distribution Method: Spear-phishing emails with malicious attachments, often masquerading as legitimate maritime business documentation. Infrastructure pivoting via specific C2 IPs.
- Payload Behavior: Exfiltrates browser cookies, saved passwords, autocomplete data, and system information. Designed to facilitate initial access for后续的BEC攻击.
- C2 Communication: Communicates over HTTP on non-standard ports (e.g., 55615) to hardcoded IPs such as
194.156.79.122.
Toy Ghouls / GenieLocker
- Threat Actor: Toy Ghouls (Bearlyfy, Labubu).
- Malware Family: GenieLocker (Custom), historically associated with RedAlert, LockBit, Babuk.
- Targeting: Manufacturing, Construction, Finance in the Russian Federation.
- Payload Behavior: Encrypts files using XChaCha20-Poly1305 algorithm. Targets Windows, Linux, and ESXi platforms. Uses Mimikatz to dump LSASS memory for credential harvesting to spread across the network.
IOC Analysis
The provided indicators of compromise (IOCs) reveal a multi-vector threat landscape:
- Network Infrastructure (C2): Specific IP addresses (
194.156.79.122,85.17.40.98) listening on port 55615 indicate a custom C2 setup, likely unique to this RedLine cluster to avoid detection on standard web ports. - Typosquatting Domains: A list of domains ending in
.shopand.online(e.g.,acasiallc.shop,softinsallc.online) demonstrates a clear Domain Impersonation tactic. These domains are used in phishing links to deliver the initial stealer payload. - File Hashes: A significant list of MD5 hashes associated with the GenieLocker ransomware payload. These should be blocklisted immediately on endpoints.
Operational Guidance:
- SOC teams should ingest the listed IPs and Domains into network firewalls and secure web gateways (SWG) for immediate blocking.
- EDR solutions should be configured to hunt for the specific MD5 hashes provided for GenieLocker.
- Threat hunters should look for DNS requests resolving to the
.shopand.onlineTLDs mentioned in the pulse, as these are low-reputation TLDs often used in these campaigns.
Detection Engineering
YAML
---
title: RedLine Stealer C2 Connection - Maritime Campaign
id: 8a3f1b92-4c5d-4f8a-9e1a-1b2c3d4e5f6a
description: Detects network connections to known RedLine Stealer C2 infrastructure associated with the maritime targeting campaign.
status: experimental
date: 2026/08/01
author: Security Arsenal
references:
- https://otx.alienvault.com/pulse/64271f5c8d69c6e0e5b8d5a6
tags:
- attack.credential_access
- attack.command_and_control
- attack.t1071.001
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationIp|startswith:
- '194.156.79.122'
- '85.17.40.98'
DestinationPort: 55615
Initiated: 'true'
condition: selection
falsepositives:
- Legitimate traffic to these IPs (unlikely given port assignment)
level: critical
---
title: Toy Ghouls GenieLocker Mimikatz Usage
id: 9b4e2c03-5d6e-0g9b-0f2b-2c3d4e5f6a7b
description: Detects execution patterns associated with Toy Ghouls GenieLocker campaign utilizing Mimikatz for credential dumping.
status: experimental
date: 2026/08/01
author: Security Arsenal
references:
- https://otx.alienvault.com/pulse/65182g6h9i7j8k9l0m1n2o3p
tags:
- attack.credential_access
- attack.t1003.001
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\mimikatz.exe'
- '\mimidrv.sys'
selection_cmd:
CommandLine|contains:
- 'sekurlsa::logonpasswords'
- 'crypto::exportPFX'
selection_genie:
Image|contains: '\AppData\Local\Temp\'
Hashes|contains: 'MD5=18f61c6d686cffd131c9fd3f3437064b' # Example from pulse
condition: 1 of selection_*
falsepositives:
- Administrator usage of Mimikatz for troubleshooting (rare)
level: high
---
title: Typosquatting Domain Access - Business Email Compromise Vector
id: 0c5f3d14-6e7f-1h0c-1g3d-3d4e5f6a7b8c
description: Detects DNS requests or HTTP connections to known typosquatting domains used in the maritime spear-phishing campaign.
status: experimental
date: 2026/08/01
author: Security Arsenal
references:
- https://otx.alienvault.com/pulse/64271f5c8d69c6e0e5b8d5a6
tags:
- attack.initial_access
- attack.t1566.001
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|contains:
- 'acasiallc.shop'
- 'amdocsllc.shop'
- 'ansysllc.shop'
- 'cimentosservices.online'
- 'epsilongroup.online'
- 'softinsallc.online'
condition: selection
falsepositives:
- Unknown
level: medium
kql
// Hunt for GenieLocker File Hashes and C2 Connections
DeviceNetworkEvents
| where RemoteIP in ("194.156.79.122", "85.17.40.98")
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
| union (
DeviceProcessEvents
| where SHA256 in ("18f61c6d686cffd131c9fd3f3437064b", "25480dad40152ef3d0c6d38eecc9bd9b", "34a7f28e0bb69b0d49bacc88bdf20ac1", "34b8828635f88078735799a3c1ac8e28", "3a4479b51890373bfc4a011ef41fe376", "58c0dda52b8f069660166d61fd74f911", "5d62c1349b8981c396c9a23f4f8f053c", "780c8f4c6f077da9da96582987920362")
| project Timestamp, DeviceName, FileName, SHA256, FolderPath, InitiatingProcessAccountName
)
| order by Timestamp desc
powershell
<#
.SYNOPSIS
IOC Hunt Script for GenieLocker and RedLine Infostealers
.DESCRIPTION
Scans the system for specific GenieLocker file hashes and checks for network connections
to known RedLine C2 infrastructure.
#>
$GenieLockerHashes = @(
"18f61c6d686cffd131c9fd3f3437064b",
"25480dad40152ef3d0c6d38eecc9bd9b",
"34a7f28e0bb69b0d49bacc88bdf20ac1",
"34b8828635f88078735799a3c1ac8e28",
"3a4479b51890373bfc4a011ef41fe376",
"58c0dda52b8f069660166d61fd74f911",
"5d62c1349b8981c396c9a23f4f8f053c",
"780c8f4c6f077da9da96582987920362"
)
# Check for GenieLocker Hashes on C: drive
Write-Host "Scanning for GenieLocker file hashes..."
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Length -gt 0kb } |
ForEach-Object {
$hash = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
if ($GenieLockerHashes -contains $hash) {
Write-Host "[!] MATCH FOUND: $($_.FullName) (MD5: $hash)" -ForegroundColor Red
}
}
# Check for active network connections to RedLine C2 IPs
Write-Host "Checking active connections for RedLine C2 IPs..."
$C2_IPs = @("194.156.79.122", "85.17.40.98")
$netstat = netstat -ano | Select-String "ESTABLISHED"
foreach ($line in $netstat) {
$parts = $line -split '\s+'
$remoteAddress = $parts[2] -split ':'
$ip = $remoteAddress[0]
if ($C2_IPs -contains $ip) {
$pid = $parts[-1]
$process = Get-Process -Id $pid -ErrorAction SilentlyContinue
Write-Host "[!] C2 CONNECTION DETECTED: IP $ip connected by PID $pid ($($process.ProcessName))" -ForegroundColor Red
}
}
# Response Priorities
* **Immediate**: Block all IOCs (IPs, Domains, File Hashes) at the perimeter and endpoints. Isolate any systems showing positive matches for the GenieLocker hashes or network connections to the RedLine C2 IPs.
* **24h**: Conduct credential audits and forced password resets for accounts that may have been compromised by the RedLine/Formbook infostealers, particularly for users in the maritime manufacturing or logistics sectors. Verify the integrity of ESXi hosts in the manufacturing sector.
* **1 Week**: Implement strict allow-listing for outbound traffic to prevent C2 communication. Review and harden email filtering to detect and block typosquatting domains and spear-phishing attempts targeting specific industries.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.