Skip to content
NewA calmer, faster ZeroHour
StoryRansomwarehigh

AttackIQ maps Beast ransomware’s hidden console and GodDamn link

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

AttackIQ’s October 2026 analysis details Beast ransomware’s hidden 666 console, backup disruption, and a GodDamn link to Hyadina.

AttackIQ’s October 23, 2026 analysis describes a 32-bit, 81 KB Beast ransomware sample whose hidden console opens with ALT+CTRL and the code 666. Cyber Security News says the ransomware-as-a-service strain appeared on RAMP in June 2024 as a successor to Monster. Before encryption it stops backup and security tools, deletes shadow copies through WMI, and targets local drives and SMB shares using ChaCha20 and Curve25519. Symantec and Carbon Black attribute Beast and a GodDamn rebrand to developer Hyadina; Symantec reported a July 2026 return under that name. GBHackers says the leak site remains active, with the latest reported Beast activity on August 30, 2026.

Key facts
  • 32-bit C/C++ sample compiled August 9, 2024, and sized at 81 KB.
  • Operators stop or terminate 52 processes and 73 services before encryption.
  • Sample encrypts 25% of 128 KiB chunks, capping large files at 512 MiB.
  • Encrypted files use a .moon extension; README.TXT and default.key are written.
  • It probes TCP 445, skips ADMIN$, and beacons an IP-logging URL.
  • The sample skips systems whose locales match CIS and other countries.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Aug 9, 2024Analyzed 32-bit Beast sample was compiled. · GBHackers
  2. Aug 30, 2026Latest reported Beast activity, per GBHackers. · GBHackers
  3. Oct 23, 2026AttackIQ published its Beast ransomware analysis. · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersGives the 81 KB size, compile date, locale skips, and August 30 activity.
  • Cyber Security NewsAdds ChaCha20 parameters, RAMP origin, persistence, and beacon behavior.
Vendors
MicrosoftBroadcomVMware
Products
WindowsVMware ESXiAnyDesk
Threat actors
Hyadina
Malware
BeastMonsterGodDamn RansomwareGodDamnPoisonX
Organizations
AttackIQSymantecCarbon Black

Coverage

oldest first · one row per article · UTC
  1. · 1d ago GBHackersFirst report

    Beast ransomware wipes recovery options before encrypting network shares

    AttackIQ analyzed an 81 KB sample with a hidden GUI, and Symantec links developer Hyadina to a GodDamn rebrand.

  2. · 1d ago Cyber Security News

    Beast ransomware uses a hidden 666 panel to encrypt Windows

    AttackIQ’s October 23, 2026 analysis maps ChaCha20 encryption, SMB share targeting, and shadow-copy deletion on a 32-bit sample.