Hackers Deploy Beast Ransomware to Disable Backup Services, Delete Shadow Copies, and Encrypt Network Drives

A Beast ransomware payload gives affiliates an interactive graphical console and the ability to override its embedded settings.

It also wipes recovery options before it encrypts. AttackIQ published its analysis of the sample on October 23, 2026.

Symantec and Carbon Black attribute both families to a developer they track as Hyadina. Symantec reported on July 9, 2026 that Hyadina had rebranded again as GodDamn, which has significant code overlap with Beast.

In one GodDamn intrusion, attackers used AnyDesk, a NirSoft credential-harvesting toolkit, and the Microsoft-signed PoisonX kernel driver to blind endpoint defenses before they deployed the encryptor.

The original Beast leak site remains active, and the latest reported Beast activity dates to August 30, 2026. The operators may therefore be continuing under a new name.

The analyzed sample is an 81 KB, 32-bit C/C++ executable compiled on August 9, 2024. It builds its strings on the stack and decodes them with a single-byte XOR key, 0x55.

It also decrypts a ChaCha20-protected configuration from its .data section. The key and nonce sit immediately before that blob, so analysts can recover the configuration through static analysis.

The configuration holds two attacker public keys, the exclusion lists, the service and process kill lists, the ransom note and the beacon URL.

Operators open the GUI by pressing ALT+CTRL and typing 666. From there they enumerate drives, shares and subnets, choose targets, and start, pause, resume or stop encryption while they watch progress.

Command-line switches override the embedded defaults. -K kills processes and services, -S deletes shadow copies, -N enables network discovery, -M mounts hidden volumes, and -P sets the encryption percentage.

Before encryption, Beast creates the mutex “BEAST HERE?” and skips systems whose locale matches CIS and several other countries.

It then contacts iplogger[.]co/1v1i85.torrent twice, once before encryption and once after. The victim ID travels in the User-Agent header and the BEGIN or END marker in the Referer header. This tells the operator when the job started and finished.

AttackIQ observed that, Beast is a ransomware-as-a-service operation that surfaced on the RAMP forum in June 2024. It is reportedly the successor to Monster, which was advertised on the same forum in March 2022.

Beast Ransomware Attack

Persistence uses an HKCU Run key named for the victim GUID. With the -I flag, Beast first copies itself to %ALLUSERSPROFILE% under a random eight-letter name.

It enables SeTakeOwnershipPrivilege, then terminates 52 processes and stops 73 services covering backup, database, security and office software.

When a file is still locked, it calls the Windows Restart Manager to release it. It deletes shadow copies by querying Win32_ShadowCopy through WMI and calling DeleteInstance on each result. This requires administrative rights. It also empties the Recycle Bin.

For network reach, Beast reads the ARP cache with GetIpNetTable and keeps private ranges. It reduces them to unique /24 subnets and probes TCP/445 asynchronously.

It enumerates the shares on responding hosts, excludes ADMIN$, and queues the rest as UNC paths for encryption. It also mounts volumes that have no drive letter.

Beast combines ChaCha20 with a Curve25519 key hierarchy. The malware generates a per-machine session keypair and protects its private key under each of the two attacker public keys.

Each file then receives its own ephemeral keypair, and an ECDH exchange hashed with SHA-512 produces that file’s ChaCha20 key and nonce.

A 160-byte footer ends with the marker 66 6B EA 57 1A BE 16 66, which prevents double encryption. Files are processed in 128 KiB chunks, and the analyzed build encrypts 25 percent of them with a minimum of three.

At 1 GiB and above, it encrypts alternating chunks from the start of the file, up to 4,096 of them. That caps the damage at 512 MiB. Encrypted files are renamed to .{}.moon.

Intermittent encryption speeds up attacks on large shares and leaves large database and backup files only partly damaged at the front.

Defenders should alert on WMI shadow-copy deletion, mass service stops, ARP-driven SMB scanning and traffic to IP-logging domains.

They should also watch for Run keys that point to randomly named binaries under %ALLUSERSPROFILE%.

AttackIQ has released an emulation for its Adversarial Exposure Validation platform that reproduces the Beast chain, so teams can test their detection and prevention controls against it.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.