Beast ransomware wipes recovery options before encrypting network shares
Original title: Hackers Deploy Beast Ransomware to Disable Backup Services, Delete Shadow Copies, and Encrypt Network Drives
AttackIQ analyzed an 81 KB sample with a hidden GUI, and Symantec links developer Hyadina to a GodDamn rebrand.
AttackIQ published an analysis on October 23, 2026 of a Beast ransomware sample that gives affiliates a graphical console and command-line overrides. Before encryption it stops backup and security services, deletes shadow copies through WMI, and scans private subnets over SMB. Symantec and Carbon Black attribute Beast and GodDamn to a developer tracked as Hyadina. The original leak site remains active, with the latest reported Beast activity on August 30, 2026.
Unconfirmed: Whether operators continue as GodDamn rests on Symantec and Carbon Black attribution and reported code overlap.
- The 32-bit C/C++ sample was compiled on August 9, 2024 and is 81 KB.
- Operators open the GUI by pressing ALT+CTRL and typing 666.
- It terminates 52 processes and stops 73 services before encryption.
- Encrypted files use the .{victim-id}.moon extension and a README.TXT note.
- Beast skips systems whose locale matches CIS and several other countries.
Impact: Deletes backups and shadow copies, then encrypts network shares
- 1.Alert on WMI shadow-copy deletion, mass service stops, and ARP-driven SMB scanning.
- 2.Watch for Run keys pointing to randomly named binaries under %ALLUSERSPROFILE%.
- 3.Watch for traffic to IP-logging domains used as encryption beacons.
- ATT&CK
- T1490 Inhibit System RecoveryT1486 Data Encrypted for ImpactT1489 Service StopT1547.001 Registry Run Keys / Startup FolderT1021.002 SMB/Windows Admin Shares
- Products
- AnyDesk
- Threat actors
- Hyadina
- Organizations
- AttackIQSymantecCarbon Black
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | iplogger.co | e matches CIS and several other countries. It then contacts iplogger[.]co/1v1i85.torrent twice, once before encryption and once aft |
| sha256 | 4c44ac1eea4bc7f4ea542d611b5658d7ac2729d79abe750da83f1581cd832eaf | ols against it. Indicators of Compromise Type Value SHA-256 4c44ac1eea4bc7f4ea542d611b5658d7ac2729d79abe750da83f1581cd832eaf Mutex BEAST HERE? Encrypted file extension .{<victim-GUID>} |
From the original article
4 min read at gbhackers.com
A Beast ransomware payload gives affiliates an interactive graphical console and the ability to override its embedded settings. It also wipes recovery options before it encrypts. AttackIQ published its analysis of the sample on October 23, 2026.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.