Genesis is a cybercriminal group that emerged in October 2025, rapidly establishing itself as a significant player in digital extortion. This group is distinct from the Genesis Market, a separate marketplace for stolen credentials that was dismantled in 2023. Genesis ransomware group's primary motivation is financial gain, achieved through a unique double extortion model that focuses predominantly on data exfiltration and public leaks rather than encrypting victim systems. This strategic emphasis on public exposure of sensitive data to exert financial and reputational pressure on victims sets them apart from many traditional ransomware operations. Their rapid appearance and organized operational structure suggest the involvement of experienced threat actors, potentially from other cybercriminal entities.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.