Loading threat actor…
Bearlyfy, also known as Labubu, is a pro-Ukrainian threat actor that emerged in January 2025 and has been linked to more than 70 cyberattacks against Russian companies. The group is assessed as a dual-purpose actor combining financially motivated ransomware extortion with sabotage-oriented disruption intended to inflict damage on Russian business operations. Reporting indicates the group evolved quickly from relatively unsophisticated early activity against smaller firms into a significant threat to larger Russian enterprises. Bearlyfy has primarily targeted Russian businesses and has also been linked through ecosystem relationships to activity affecting Belarusian entities. Its operations have relied on exploitation of exposed external services and vulnerable applications for initial access, followed by remote access tooling such as MeshAgent. After compromise, the group has used access to encrypt, destroy, or modify victim data. Operationally, Bearlyfy has been characterized by rapid attacks with limited preparation and swift execution. The actor initially relied on existing or modified ransomware derived from leaked or third-party code, including LockBit 3, Babuk, and later a modified PolyVice variant. Since March 2026, Bearlyfy has deployed a proprietary Windows ransomware family known as GenieLocker. GenieLocker is assessed to incorporate anti-analysis features and to borrow elements from the Venus and Trinity ransomware families. Bearlyfy’s ransom tradecraft has included both conventional ransomware deployment and manually delivered coercive messages; in earlier operations, ransom notes were often crafted separately rather than generated by the encryptor itself, while later GenieLocker attacks automated note generation. Demands reportedly escalated from comparatively modest sums to hundreds of thousands of dollars, with a minority of victims paying. Bearlyfy has been associated with the broader pro-Ukrainian intrusion ecosystem through observed overlaps in tooling and infrastructure with PhantomCore and collaboration with Head Mare, while retaining a distinct operational style. Overall, the group is best understood as a politically aligned pro-Ukrainian actor that blends ransomware-enabled financial extortion with destructive and disruptive attacks against Russian organizations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
25 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Dual-purpose ransomware and sabotage group targeting Russian businesses, conducting rapid attacks for both extortion and destructive impact.
Pro-Ukrainian ransomware and disruptive operations targeting Russian companies, combining political and financial motives and escalating from small-business attacks to larger enterprises with custom ransomware.
Проукраинская группа, осуществившая более 70 атак на российские компании с января 2025 года, совмещая вымогательство с диверсионной деятельностью. Сначала использовала чужие и модифицированные ransomware-семейства, а с марта 2026 года перешла на собственные шифровальщики, включая GenieLocker.
Newly described ransomware group; noted as having a connection to PhantomCore.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.