Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Malware Families
Excerpt
Introduction We continue tracking the activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group that has been targeting Russian organizations since 2025. The attackers initially relied exclusively on tools pulled from public GitHub repositories along with leaked Babuk and LockBit ransomware builders, later shifting to their own custom ransomware, GenieLocker . In early July 2026, we observed the group using a custom backdoor for…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | meet.element.tw | High | Score 63/100 | First seen |
| MD5 | bfadbeee63a4f0bf19ec9deb8fa58f58 | Medium | Score 53/100 | First seen |
| MD5 | 7916c33688385525078bee504c90f359 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…