Bearlyfy's GenieLocker: When Ransomware Becomes a Geopolitical Wiper
Just caught the report on Bearlyfy (aka Labubu) hitting over 70 Russian firms with a new strain called GenieLocker. Given the pro-Ukrainian attribution and the quote about "inflicting maximum damage," this sounds less like a financially motivated ransomware operation and more like a wiper disguised as ransomware.
Since it's a custom Windows strain, standard decryptors likely won't work. The group's dual-purpose approach suggests they might exfiltrate data for leaks while encrypting or destroying files to disrupt operations. For those of us monitoring supply chains or multinational entities, the collateral damage risk is real if they move up the chain.
I've been digging into potential Indicators of Compromise (IOCs) based on similar custom loaders. If you're hunting for this, check for unusual PowerShell execution chains and persistence mechanisms in the Run keys.
Here is a quick KQL query for Microsoft Sentinel to look for suspicious process creation patterns often associated with custom loaders:
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoOriginalFileName =~ "powershell.exe" or ProcessVersionInfoOriginalFileName =~ "cmd.exe"
| where ProcessCommandLine has "-enc" or ProcessCommandLine has "-w hidden"
| where ProcessCommandLine has "FromBase64String"
| summarize count() by DeviceName, ProcessCommandLine
| sort by count_ desc
Also, keep an eye on the registry for persistence. I'd recommend checking for unsigned binaries launching from these paths:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, @{N='Value'; E={$_.PSObject.Properties.Value}} | Where-Object { $_.Value -match "\\AppData\\" }
Has anyone else started building detection rules for GenieLocker specifically, or are we relying on generic behavioral analysis for now?
We don't have direct targets in that region, but we updated our blocklists based on the initial IOCs from the article. Our biggest concern is the 'custom' nature of the malware. When they use bespoke tools, signature-based detection often fails until the sample is widely distributed. We're focusing heavily on monitoring for anomalous file access patterns (mass encryption) rather than waiting for the hash.
Interesting mention of it being a 'dual-purpose' group. In my experience, that often means the encryption is just a distraction for the destructive wiping activity happening in the background. You might want to check for VSS shadow copy deletions using vssadmin.exe as a precursor to the encryption process.
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4656; ProcessName='vssadmin.exe'} | Select-Object TimeCreated, Message
The geopolitical angle makes attribution easier, but defense harder because they don't care about 'doing business' safely. They just want the boom. We've started locking down RDP aggressively and enforcing strict MFA for all admin accounts, as that seems to be the initial entry vector for these types of ideologically motivated groups recently.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access