BearlyfyThreat actor
- Labubu
Bearlyfy has been attributed to over 70 cyber attacks targeting Russian companies since its emergence in January 2025, employing a custom Windows ransomware strain known as GenieLocker. The group operates with dual objectives of extortion and sabotage, utilizing a modified version of PolyVice and leveraging vulnerabilities in external services and applications for initial access.From MISP Galaxy
Last reported 10 days ago, by Risky Business News3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1014Rootkit
“XWorm now also includes a rootkit, a GPS location data harvester, and a webcam and microphone recording module—bringing it closer to a spyware strain than an infostealer.”
- T1021.006Windows Remote Management
“In this campaign, the attackers use Windows Remote Management (WinRM) to deliver the backdoors and their configuration files to compromised systems.”
- T1218.002Control Panel
“cplsupport (Problem Reports Control Panel)”
- T1543.003Windows Service
“The backdoor can both run within an interactive command-line session and establish persistence as a Windows service, using the --install or install option, depending on the backdoor version.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Risky Bulletin: Spyware chip found in Ledger crypto-wallets“Imagine sexting with a virtual Labubu operated by a company with arguably the worst privacy track record on the planet:”
-
Risky Bulletin: BEC campaign steals €35 million from French notaries“Angry Birds backdoor: The Toy Ghouls e-crime group (or Labubu, Bearlyfly) is deploying a new backdoor named Angry Birds in its ransomware attacks targeting Russian orgs.”
-
Angry Birds: Toy Ghouls’ new toys“We continue tracking the activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group that has been targeting Russian organizations since 2025.”
Indicators in its reports
named in the reports above- laboo[.]booin 1 report
- hxxp://ip-api[.]com/jsonin 1 report
- broker.hivemq[.]comin 1 report
- meet.element[.]twin 1 report
- bfadbeee63a4f0bf19ec9deb8fa58f58in 1 report
- 7916c33688385525078bee504c90f359in 1 report
- collusion[.]wikiin 1 report
- hneumannmep.bsky[.]socialin 1 report
- katie-drummond.bsky[.]socialin 1 report
- ua[.]newsin 1 report
- alexmartin.bsky[.]socialin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.