Skip to content
Threat Feed
Subscribe

Product

PsExec

2 briefs RSS
high threat

Toy Ghouls Deploying Custom GenieLocker Ransomware

The Toy Ghouls threat actor is deploying a custom ransomware family called GenieLocker against manufacturing organizations, utilizing compromised VPN credentials and legitimate system tools for lateral movement and encryption.

Windows +6 Toy Ghouls ransomware extortion manufacturing toy-ghouls
1r 4t 1i
medium advisory

Suspicious Process Execution via Renamed PsExec Executable

The rule identifies suspicious PsExec activity where the psexec service is executed from a renamed executable, possibly to evade detection and enable lateral movement.

PsExec +1 lateral-movement defense-evasion windows
2r 3t