Genesis
A double extortion ransomware group that began claiming victims in October 2025, mainly in the United States. It should not be confused with Genesis Market, the credentials marketplace dismantled in 2023.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Few credible public sources cover this name. This page states only what they support, so gaps here do not mean the group lacks those capabilities.
Comparitech reports that Genesis encrypts systems and steals data, then demands payment for a decryption key and for deleting the data, posting it on a leak site if unpaid.1
Its claims need care. In the cases we reviewed, organisations confirmed an incident but did not confirm the group's specific claims, and Comparitech says it could not verify the group's claim in one of them.1,2 A Canadian clinic did confirm that data was stolen.3
Name confusion is a real risk. Proven Data treats this group as separate from Genesis Market, a marketplace dismantled in April 2023, and reports no confirmed link.4 Proven Data lists the UK among places where the group has claimed victims, without detail, so the sources do not establish a meaningful UK link.4
There is little public technical detail, so we would not build specific detections around this name. Standard ransomware controls and a tested extortion plan are the practical response.
Vulnerabilities
The sources we reviewed do not reliably tie a CVE to Genesis.
Key Events
Begins adding victims to its leak site.1
Claims a breach at a finance firm, which later reports unauthorised access to a legacy server without acknowledging the claim.2
A city in Michigan confirms an IT security incident following a claim by the group.1
Claims data theft from a Canadian clinic, which confirms data was stolen.3
Defences That Matter
Harden Access
- Train staff to recognise social engineering, the route teiss reports.
- Use phishing-resistant MFA for remote access.
Retire Legacy Servers
- Find old file servers, including those hosted by third parties, and decommission or secure them.
Prepare for Double Extortion
- Keep offline backups and test them.
- Rehearse the decision on a data leak threat.
Are Your Legacy Servers Still Exposed?
We can help you find forgotten systems and prepare for an extortion demand.
Sources
- Comparitech: Michigan city confirms cyber attack following ransomware gang's claim, 9 March 2026
- Comparitech: report on a finance firm's data breach notice, 2 June 2026
- teiss: report on a Genesis claim against a Canadian clinic, 13 May 2026
- Proven Data: Genesis Ransomware: Threat Actor Profile, 18 August 2026