Skip to content
brandefense.io
Request A Demo
CybercrimeFinancialIntermediate sophistication

Bearlyfy

Bearlyfy is a cybercrime syndicate with a financial motive, tracked by Brandefense. It uses 5 MITRE ATT&CK techniques.

Also known as
  • Labubu
Request IOC feedRequest ATT&CK export
Techniques
5
Exploited CVEs
No CVE data
First seen
Oct 10, 2024
Last seen
Oct 10, 2024
Record updated

About Bearlyfy.

Bearlyfy has been attributed to over 70 cyber attacks targeting Russian companies since its emergence in January 2025, employing a custom Windows ransomware strain known as GenieLocker. The group operates with dual objectives of extortion and sabotage, utilizing a modified version of PolyVice and leveraging vulnerabilities in external services and applications for initial access. Analysis reveals overlaps with PhantomCore, indicating a pro-Ukrainian interest, while Bearlyfy's attacks are characterized by minimal preparation and a focus on immediate impact through data encryption and destruction. Approximately 20% of victims reportedly pay the ransom, with demands escalating to hundreds of thousands of dollars.

Last updated Sep 21, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.