Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware

This article covers Bearlyfy, a pro-Ukrainian threat group that has targeted over 70 Russian companies with ransomware since January 2025.

• •Bearlyfy (also known as Labubu) pursues dual objectives: financial extortion and sabotage against Russian businesses
• •Early attacks used LockBit 3 (Black), Babuk, and a modified PolyVice ransomware; initial ransom demands reached ~€80,000
• •The group shares infrastructure overlaps with PhantomCore and has collaborated with Head Mare, both groups aligned with Ukrainian interests
• •Initial access is gained via exploitation of external services and vulnerable applications, with MeshAgent used for remote access
• •Since March 2026, Bearlyfy deploys a custom ransomware called GenieLocker targeting Windows, with encryption inspired by Venus/Trinity families