Malware - Pro-Ukraine Group Bearlyfy Escalates Attacks

What Happened

A pro-Ukrainian hacker group named Bearlyfy has ramped up its cyber operations against Russian companies, executing over 70 attacks in the past year. Initially, the group targeted smaller businesses, but it has since evolved into a formidable threat to larger firms. Researchers from the Russian cybersecurity firm F6 report that Bearlyfy's ransom demands have skyrocketed, now reaching into the hundreds of thousands of dollars.

The group, which emerged in January 2025, has shifted its tactics significantly. Early on, they relied on existing ransomware tools, but they have recently begun deploying their own custom malware. This evolution marks a new phase in their operations, indicating a growing sophistication in their cyber capabilities.

Who's Being Targeted

Bearlyfy's primary targets are large Russian companies, reflecting both financial motives and a desire to inflict political damage. The group's operations have become a significant concern for the Russian business community, as they aim to maximize disruption while generating revenue through ransom payments. F6 estimates that approximately one in five victims pays the ransom, highlighting the financial impact of these attacks.

The group's aggressive tactics and escalating demands suggest a well-planned strategy to undermine Russian economic stability while supporting Ukraine's broader geopolitical goals. Their ability to adapt and innovate makes them a formidable adversary in the ongoing cyber conflict.

Signs of Infection

Bearlyfy has developed a custom ransomware strain called GenieLocker, which they have been using since early March. Unlike many ransomware operations, GenieLocker does not always generate ransom notes automatically. Instead, attackers sometimes craft their own messages, which can range from simple instructions to mocking statements directed at the victim company.

This personalized approach adds a psychological element to the attack, further increasing the pressure on victims to comply with ransom demands. Earlier, Bearlyfy utilized tools derived from leaked ransomware code, such as LockBit 3 Black and a modified version of Babuk for Linux systems, showcasing their resourcefulness and adaptability.

How to Protect Yourself

To safeguard against threats like Bearlyfy, companies should implement robust cybersecurity measures. Here are some recommended actions:

• Regularly update software to patch vulnerabilities.
• Educate employees about phishing and social engineering tactics.
• Backup critical data frequently and store it offline.
• Monitor network traffic for unusual activity that may indicate a breach.

Additionally, organizations should consider investing in advanced threat detection systems and engage in regular security audits to identify potential weaknesses. Staying informed about emerging threats like Bearlyfy can help businesses remain vigilant and prepared against ransomware attacks.