Hackers Deploy Beast Ransomware to Disable Backup Services, Delete Shadow Copies, and Encrypt Network Drives - GBHackers News

The Beast ransomware payload provides affiliates with an interactive graphical console and the ability to override embedded settings. Before encrypting files, the malware systematically wipes recovery options, leaving victims with limited restoration possibilities. AttackIQ published its analysis of the sample on October 23, 2026, revealing the ransomware's sophisticated capabilities.

Security researchers at Symantec and Carbon Black attribute both ransomware families to a developer they track as Hyadina. Symantec reported on July 9, 2026, that Hyadina had rebranded again as GodDamn, which shows significant code overlap with Beast. This suggests the same threat actor continues operations under different names.

Technical Capabilities

The analyzed Beast sample is an 81 KB, 32-bit C/C++ executable compiled on August 9, 2024. It builds strings on the stack and decodes them using a single-byte XOR key (0x55). The malware also decrypts a ChaCha20-protected configuration from its .data section, containing two attacker public keys, exclusion lists, service and process kill lists, the ransom note, and the beacon URL.

Before encryption, Beast creates the mutex "BEAST HERE?" and skips systems whose locale matches CIS and several other countries. The malware then contacts iplogger[.]co/1v1i85.torrent twice—once before encryption and once after—to notify operators when the job started and finished.

Attack Methodology

Beast ransomware uses persistence through an HKCU Run key named for the victim GUID. With the -I flag, it first copies itself to %ALLUSERSPROFILE% under a random eight-letter name. The malware enables SeTakeOwnershipPrivilege, then terminates 52 processes and stops 73 services covering backup, database, security, and office software.

When files remain locked, Beast calls the Windows Restart Manager to release them. It deletes shadow copies by querying Win32_ShadowCopy through WMI and calling DeleteInstance on each result, requiring administrative rights. The malware also empties the Recycle Bin to further limit recovery options.

For network reach, Beast reads the ARP cache with GetIpNetTable and keeps private ranges, reducing them to unique /24 subnets. It probes TCP/445 asynchronously, enumerates shares on responding hosts (excluding ADMIN$), and queues the rest as UNC paths for encryption. The ransomware also mounts volumes without drive letters.

Encryption Technique

Beast combines ChaCha20 with a Curve25519 key hierarchy. The malware generates a per-machine session keypair and protects its private key under each of the two attacker public keys. Each file receives its own ephemeral keypair, with an ECDH exchange hashed with SHA-512 producing that file's ChaCha20 key and nonce.

A 160-byte footer ending with the marker 66 6B EA 57 1A BE 16 66 prevents double encryption. Files are processed in 128 KiB chunks, with the analyzed build encrypting 25 percent of them (minimum three). For files 1 GiB and above, it encrypts alternating chunks from the start, up to 4,096 chunks (capping damage at 512 MiB). Encrypted files are renamed to .{}.moon.

This intermittent encryption technique speeds up attacks on large shares while leaving large database and backup files only partly damaged at the front. Defenders should alert on WMI shadow-copy deletion, mass service stops, ARP-driven SMB scanning, and traffic to IP-logging domains. They should also monitor Run keys pointing to randomly named binaries under %ALLUSERSPROFILE%.