Beast ransomware uses a hidden 666 panel to encrypt Windows
Original title: Beast Ransomware Uses Hidden ‘666’ Control Panel to Encrypt Windows Systems and Network Shares
AttackIQ’s October 23, 2026 analysis maps ChaCha20 encryption, SMB share targeting, and shadow-copy deletion on a 32-bit sample.
AttackIQ reverse-engineered a 32-bit Windows sample of Beast, a ransomware-as-a-service operation that appeared on the RAMP forum in June 2024 and is described as a successor to Monster. Pressing ALT+CTRL and typing 666 opens a panel that lists drives, shares, and subnets and lets an operator start, pause, resume, stop, or reset encryption. The sample uses ChaCha20 with Curve25519, intermittent encryption, a user Run-key for persistence, and WMI to delete Volume Shadow Copies when it has admin rights. Symantec and Carbon Black link Beast to Hyadina; Symantec reported a July 2026 return as GodDamn Ransomware.
Unconfirmed: The Monster succession and the Hyadina and GodDamn links are reported by researchers, not independently confirmed here.
- The analyzed build encrypts 25% of 128 KiB chunks, with a 512 MiB cap on files of 1 GiB or larger.
- It probes TCP 445, skips ADMIN$, and mounts hidden volumes without drive letters.
- Before encryption it stops 52 processes and 73 services, including backup, database, and security tools.
- Files in this sample use the .moon extension; a README.TXT note and default.key are written.
- It beacons to an IP-logging URL with the victim ID in the User-Agent and BEGIN or END in Referer.
Impact: Encrypts Windows files and network shares and deletes shadow copies
- 1.Watch for WMI Volume Shadow Copy deletion, mass service stops, and SMB scanning on TCP 445.
- 2.Keep backups offline and limit administrative rights.
- 3.Block the published Beast hashes, mutex, registry value, beacon URL, and contact indicators.
- ATT&CK
- T1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1135 Network Share DiscoveryT1021.002 SMB/Windows Admin SharesT1547.001 Registry Run Keys / Startup Folder
- Products
- WindowsVMware ESXi
- Threat actors
- Hyadina
- Organizations
- AttackIQSymantecCarbon Black
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | onionmail.com | ail vortexecho@zohomail[.]eu Contact Email (reserve) somran@onionmail[.]com Contact Telegram @somran2024 Note: IP addresses and domai |
| domain | zohomail.eu | Network HTTP Referer BEGIN or END Contact Email vortexecho@zohomail[.]eu Contact Email (reserve) somran@onionmail[.]com Contact Te |
| sha256 | 4c44ac1eea4bc7f4ea542d611b5658d7ac2729d79abe750da83f1581cd832eaf | ors of compromise (IoCs):- Category Type Value File SHA-256 4c44ac1eea4bc7f4ea542d611b5658d7ac2729d79abe750da83f1581cd832eaf Host Mutex BEAST HERE? Host Encrypted file extension .{<vic |
From the original article
4 min read at cybersecuritynews.com
Beast ransomware has a hidden control panel. An attacker who presses ALT+CTRL and types 666 on an infected Windows machine opens a graphical interface that lets them choose what to encrypt. Most ransomware runs from the command line, so this gives affiliates (the criminals who rent the tool) much more hands-on control during an infection.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.