In an exclusive deal that would make even the Grinch blush, ToyMaker is taking playtime to a whole new level. Why settle for a quaint teddy bear when you can gift your friends and enemies alike access to the coveted CACTUS ransomware gangs? It’s the ultimate double extortion extravaganza, and it’s bound to be a hit at this year’s hacker holiday party.

This enterprising initial access broker has been thoughtfully crafting an experience like no other, inviting only those with the most vulnerable systems to play along. Just make sure your antivirus software is caught napping, and you’ll be part of the lucky ones showered with the loving embrace of LAGTOY—also affectionately known as HOLERUN in the underworld’s Build-A-Ransomware Workshop.

The financially motivated threat actor, ToyMaker, operates with medium confidence, which is more than can be said for most IT departments when they find LAGTOY dancing through their networks. As cyber defenses cower under inflated antivirus claims, the ToyMaker’s custom malware makes its way down the digital chimney, delivering surprise gifts of encrypted data and ransom demands wrapped in ribbons of binary code.