Genesis Ransomware: Threat Actor Profile

Genesis ransomware is an emerging double-extortion threat group that surfaced on public threat intelligence feeds in late October 2025. US organizations account for 89% of publicly claimed victims. This pattern reflects a deliberate focus on US small and mid-sized organizations with limited in-house incident response capacity.

If Genesis ransomware is active in your environment, contact Proven Data's incident response team immediately.

Genesis Market vs Genesis ransomware

The label "Genesis" refers to two distinct cybercrime entities that are often conflated.

Genesis Market, a criminal marketplace that sold stolen credentials, browser session cookies, and device fingerprints, was dismantled in April 2023 during Operation Cookie Monster, a coordinated action by the FBI, Dutch National Police, and law enforcement partners across 17 countries.

Genesis ransomware is a separate, currently active extortion group with no confirmed operational connection to the marketplace.

The two entities have different threat models and require different defensive responses. This article addresses Genesis ransomware exclusively.

Genesis ransomware overview

Genesis ransomware operates as a likely closed-group threat entity with low-to-moderate attribution confidence and no confirmed alternate tracking aliases as of August 2026. Operating outside a publicly confirmed Ransomware-as-a-Service (RaaS) affiliate framework, the group uses a double-extortion model.

Windows is currently the only confirmed target OS; core payload artifacts, including encryption algorithms, appended file extensions, and ransom note filenames, remain unanalyzed, and no public decryptor exists.

To date, Genesis has publicly claimed 111 victims across seven jurisdictions, including the US, UK, Canada, Denmark, Jamaica, Spain, and Malaysia.

Sector distribution heavily concentrates in Professional Services and Healthcare, with secondary exposure across Manufacturing, Technology, and Financial Services.

Notably, 26.8% of compromised organizations had infostealer data in threat intelligence feeds before exploitation, highlighting credential access as a key vector. For defenders, this elevates the priority of monitoring infostealer notification feeds and enforcing MFA across all remote access paths.

Despite recording about 18 victim claims in July, operational telemetry indicates a recent deceleration, with a 78% decline in attack velocity relative to the prior month.

Who Genesis ransomware targets

Genesis exhibits a financially motivated, opportunistic targeting pattern. Victim selection concentrates on organizations that hold legally protected, financially sensitive, or operationally critical data, the categories for which public exposure carries consequences beyond the cost of the ransom itself.

Healthcare targets account for about 20% of all publicly claimed victims. Organizations holding protected health information face compounding exposure in a Genesis incident: the HIPAA Breach Notification Rule requires notification to HHS and affected individuals when unsecured PHI is disclosed, regardless of whether encrypted data is later restored.

The group's documented practice of exfiltrating data before encryption means that restoring from backup does not close the regulatory clock. Proven Data's healthcare cybersecurity guidance outlines the notification obligations and the security controls most relevant to organizations under HIPAA.

Genesis attack lifecycle

The phases below are reconstructed from public behavioral reporting and vendor threat profiles. No confirmed malware sample analysis has been published; treat this as an operational baseline, not a definitive technical breakdown. Confidence levels reflect the evidentiary basis for each phase.

Phase 1: Initial Access

Valid account compromise is the highest-confidence initial access indicator for Genesis. Behavioral reporting consistently points to credential-based entry on VPN, RDP, and remote access infrastructure.

Vendor reporting notes phishing as a probable secondary vector, but it has not been confirmed with specific lure analysis.

Access purchased from initial access brokers is consistent with the group's profile and the elevated infostealer association rate, but has not been directly confirmed.

In many ransomware incidents of this type, the operator who deploys the ransomware is not the original intruder but someone else obtains the foothold and transfers or sells access, sometimes weeks before detonation.

Phase 2: Privilege Escalation

Genesis operators work to escalate privileges within compromised environments, moving from initial foothold credentials toward domain administrative access.

Organizations that enforce least-privilege access and audit administrative account creation significantly limit blast radius at this phase.

Phase 3: Defense Evasion

Antivirus and EDR software is disabled before exfiltration and encryption begin. Public reporting has not confirmed the mechanism. The outcome is consistent across documented incidents: security tooling goes dark before payload execution.

Phase 4: Discovery

Network reconnaissance during this phase almost certainly includes enumeration of file shares, Active Directory topology, and backup infrastructure. Genesis's sector focus on organizations with high-value protected data suggests it deliberately identifies PHI directories, client matter folders, and financial records before exfiltration begins.

Enumerating backup infrastructure to locate and destroy catalogs before encryption aligns with the group's operational pattern and is standard practice among mature ransomware operators.

Phase 5: Data Exfiltration

Sensitive corporate files are staged and transferred before encryption payloads execute. Exfiltration is the mechanism that makes double extortion structurally different from encryption-only ransomware: even a successful backup restore leaves the threat of public data release unresolved.

The specific exfiltration tooling is not documented for Genesis. Genesis's approximately 27-day average dwell time between the estimated attack date and leak-site posting indicates that intrusion, reconnaissance, exfiltration, and encryption routinely span several weeks before the victim becomes aware of the incident.

Phase 6: Encryption and Impact

Attackers delete Volume Shadow Copies immediately before encryption via vssadmin delete shadows /all /quiet or equivalent WMI commands. VSS deletion eliminates the fastest Windows-native recovery path and is a high-fidelity pre-encryption detection signal. Encryption of the environment follows.

The file extension appended to encrypted files and the encryption algorithm are not publicly confirmed.

Phase 7: Extortion

The group communicates ransom demands to the victim and stages data on the Genesis TOR leak site pending compliance.

Extortion model and leak site

Genesis operates a single known TOR-based data leak site:

genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad[.]onion

Once a threat actor publishes stolen data on a leak site, the incident shifts from containment to breach notification.

Magdy Abdelaziz, Head of DFIR at Proven Data, explains that stolen data appearing on a ransomware leak site confirms exfiltration rather than leaving it as suspicion. He notes that from that point on, organizations must treat the compromised information as permanently public, shifting their incident response strategy from technical containment to breach notification and harm reduction.

When Operation Cronos dismantled LockBit's infrastructure in February 2024, law enforcement found data belonging to victims who had paid specifically for its deletion. Deletion promises carry no enforceable guarantee from any ransomware operator, and Genesis is no exception.

DO NOT PAY THE RANSOM. Decisions about ransom payment carry legal, operational, and financial consequences, including potential OFAC sanctions exposure.

Indicators of compromise

No confirmed IOC package for Genesis ransomware has been released as of August 2026. This absence is operationally significant: IOC-based detection will not reliably identify Genesis activity before encryption begins. Behavioral detection is the primary defensive control.

Behavioral and tool-based indicators (documented):

No confirmed network IOCs, file hashes, or specific command-and-control infrastructure has been publicly attributed to Genesis. Where IOC-based rules are deployed, treat absence of a match as inconclusive rather than as clearance.

MITRE ATT&CK mapping

The table below maps documented and probable Genesis behaviors to MITRE ATT&CK techniques.

Confidence values reflect the evidentiary basis:

• Observed means the behavior is directly documented in incident reporting
• Probable means it is consistent with the group's operational pattern but has not been confirmed from a published sample or first-hand engagement.
  

Detection and threat hunting

Without a published IOC package, detection for Genesis depends on behavioral signals that precede encryption by minutes to hours. The following are the highest-yield detection priorities based on documented behavior.

VSS deletion commands

Alert on vssadmin delete shadows, wmic shadowcopy delete, or bcdedit /set {default} recoveryenabled No from any process that is not an explicitly whitelisted backup agent.

This is a near-universal ransomware pre-deployment step and warrants immediate escalation regardless of source.

Security tool process termination

Windows Event ID 4688 (process creation) combined with Sysmon Event ID 1 showing security tool processes terminated by unexpected parent processes, particularly in rapid succession, indicates ongoing defense evasion.

Credential anomalies on remote access infrastructure

Authentication to VPN or RDP gateways from geolocations not in baseline, at atypical hours, or with service accounts that have no scheduled execution reason. Given that a significant share of Genesis victims had pre-existing credential exposure in criminal markets, this detection class is disproportionately high-value against this specific group.

Bulk file reads from administrative accounts

Large-scale read operations on file shares holding PHI, client records, financial data, or legal communications, particularly from service or administrative accounts, followed by outbound traffic volume increases inconsistent with normal business operations.

RMM tool installation outside approved channels

Unexpected deployment of remote management tools by administrative accounts is a common enabler of persistence and lateral movement. Allowlist approved RMM tools and alert on installation of unlisted binaries with matching behavioral profiles.

Healthcare and professional services organizations should additionally monitor for unexpected access to protected data repositories during off-hours.

What to do if Genesis is active in your environment

If Genesis ransomware has been identified in your environment, the sequence of actions in the first hours determines whether recovery takes days or weeks.

Containment

Sever network connectivity at the switch level (VLANs, switch ports, VPN concentrators) rather than shutting down endpoints. Powering off compromised systems can destroy live memory evidence, including in-memory credentials, decryption material, and C2 configuration. Isolate domain controllers and backup repositories first. Assume day-to-day communication channels, including email and internal messaging platforms, are compromised, and coordinate on an out-of-band channel.

Abdelaziz emphasizes that recovery timelines after a ransomware attack depend not on the volume of encrypted data, but on whether core assets like Active Directory and backup infrastructure remain trustworthy. He recommends immediately severing network connectivity, pulling network cables rather than powering down systems, to isolate domain controllers and backup repositories first, followed by contacting incident response counsel and experts via out-of-band communication channels.

Evidence preservation

Preserve Windows Event logs (Security, System, Application), PowerShell script block logs (Event ID 4104), RDP session logs, VPN authentication records, and endpoint detection telemetry. Network flow records covering the 30 days preceding the encryption event are critical for establishing exfiltration scope and lateral movement path.

Follow the evidence preservation protocol before initiating any recovery actions that could overwrite forensic artifacts. Engage Proven Data's ransomware breach response team before recovery begins.

Persistence hunting

Genesis's dwell time means operators had significant access before encryption. Inventory scheduled tasks, modified Group Policy Objects, new local administrator accounts, and backdoored service accounts across the entire environment.

Credential rotation

Rotate all domain administrative, service account, and VPN credentials. Prioritize accounts that show authentication events within the 30 days before the encryption event. Assume all credentials present in memory on compromised systems are compromised.

Regulatory exposure assessment

Healthcare organizations should begin HIPAA breach assessment immediately. The 60-day notification window runs from the date of discovery, not the date of encryption.

Organizations subject to SEC cybersecurity disclosure rules should consult legal counsel on materiality determination before any public statements. The legal classification of an incident, whether it constitutes a formal data breach under applicable law, determines which notification timelines apply and must be established before communications go out.

Recovery sequencing

Restore exclusively from offline or air-gapped backups that predate the intrusion. Verify backup integrity before restoration. Restore into a clean network environment and do not trust Active Directory until it has been audited and rebuilt where necessary.

The real bottleneck in extended recovery scenarios is almost never data restoration; it is establishing verified eradication, validating backup integrity, confirming application interdependencies, and clearing the decision-making cycle with legal and insurance stakeholders. Set those expectations with leadership before recovery begins.

Can files encrypted by Genesis be recovered?

No public decryptor for Genesis ransomware exists as of August 2026. No More Ransom and major vendor decryptor repositories do not list a Genesis tool. CISA has not published an advisory or recovery guidance specific to this group.

Because no public malware sample has been analyzed, the encryption implementation cannot be independently assessed. Cryptographic weaknesses that enable keyless decryption exist in poorly implemented ransomware strains, but it is unknown whether Genesis's implementation includes them. Organizations should not assume keyless decryption is feasible.

Backup restoration is the only reliable recovery path that does not require paying the ransom. It requires offline or air-gapped backups that predate the intrusion, have been verified clean, and Genesis operators have not reached during the discovery phase.

Many organizations discover during an incident that their backups were untested, encrypted alongside production data, or had their catalogs destroyed. That’s why backup posture and recovery testing are the highest-impact preventive controls against this type of ransomware.

Organizations without viable backup options should contact Proven Data's recovery team for an assessment before deciding whether to pay.

Security checklist

The controls below are directly tied to Genesis's documented behaviors. Each item addresses a specific step in the group's operational chain.

• Enforce MFA on every remote access path
• Isolate backup infrastructure from the primary domain
• Alert on VSS deletion commands
• Baseline and monitor privileged account activity
• Implement DLP controls on high-value data repositories
• Test backup restoration on a defined schedule
• Patch internet-facing remote access infrastructure on a defined SLA