Beast Ransomware (RaaS) Disables Backup Services, Deletes Shadow Copies, and Encrypts Network Drives

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5940 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Beast Ransomware - Shadow Copy / Backup Destruction (WMI Win32_ShadowCopy, vssadmin, wbadmin, disable_backup.bat)

Beast (TL-2026-5940, Hyadina RaaS, rebrand GodDamn) enumerates Win32_ShadowCopy through WMI and calls DeleteInstance before encrypting, and affiliates run disable_backup.bat to wreck backups and VSS. This behaviour-first search catches the command-line forms of that recovery inhibition (T1490), including WMI-based deletion (T1047), in Sysmon process creation. Native in-process DeleteInstance calls by the encryptor itself need WMI-Activity telemetry, so pair this with the file-artifact and service-stop detections.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1490, T1047
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
( (Image="*vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*")
OR (Image="*wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*")
OR (Image="*wbadmin.exe" CommandLine="*delete*" (CommandLine="*catalog*" OR CommandLine="*backup*" OR CommandLine="*systemstatebackup*"))
OR (Image="*bcdedit.exe" CommandLine="*recoveryenabled*" CommandLine="*no*")
OR ((Image="*powershell.exe" OR Image="*pwsh.exe") CommandLine="*Win32_ShadowCopy*" (CommandLine="*Delete*" OR CommandLine="*Remove-CimInstance*" OR CommandLine="*DeleteInstance*"))
OR CommandLine="*disable_backup.bat*" )
| eval technique="T1490 Inhibit System Recovery", wmi_path=if(like(CommandLine,"%Win32_ShadowCopy%") OR like(Image,"%wmic.exe"),"T1047 WMI","none")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(technique) as technique values(wmi_path) as wmi_path by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete" and ProcessCommandLine has_any ("catalog", "backup", "systemstatebackup"))
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled" and ProcessCommandLine has "no")
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Win32_ShadowCopy" and ProcessCommandLine has_any ("Delete", "Remove-CimInstance", "DeleteInstance"))
    or ProcessCommandLine has "disable_backup.bat"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: Beast Ransomware Shadow Copy and Backup Destruction (TL-2026-5940)
id: 7c1d3f52-9a4e-4b61-8d2a-5e0b1c7a3f01
status: experimental
description: Detects Beast and GodDamn style recovery inhibition using vssadmin, wmic, wbadmin, bcdedit and PowerShell Win32_ShadowCopy deletion plus the affiliate disable_backup.bat script.
references:
    - https://www.attackiq.com/2026/10/23/beast-ransomware/
    - https://www.security.com/blog-post/goddamn-ransomware-beast-rebrand
    - https://www.hivepro.com/threat-advisory/tracking-beast-tools-techniques-and-tradecraft-in-raas-operations
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.impact
    - attack.t1490
    - attack.execution
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_wbadmin_catalog:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'catalog'
    selection_wbadmin_backup:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'backup'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains|all:
            - 'recoveryenabled'
            - 'no'
    selection_ps_delete:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Win32_ShadowCopy'
            - 'Delete'
    selection_ps_cim:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Win32_ShadowCopy'
            - 'Remove-CimInstance'
    selection_script:
        CommandLine|contains: 'disable_backup.bat'
    condition: 1 of selection_*
falsepositives:
    - Backup software or admins legitimately pruning shadow copies
    - Disk cleanup or imaging scripts that run vssadmin delete shadows
level: high

Known false positives:

• Backup or imaging products that legitimately delete shadow copies or catalogs during maintenance
• Administrators running vssadmin delete shadows to reclaim disk space

Tuning notes: Allow-list known backup servers and admin jump hosts by host and ParentImage. Raise to critical when the same host also shows service-stop bursts (SIG-001) or .moon file creation (KQL-001) within 30 minutes. Enable Microsoft-Windows-WMI-Activity/Operational (EID 5857/5861) to see in-process Win32_ShadowCopy DeleteInstance calls.

• 🔒 Beast Ransomware - Encrypted File (.{GUID}.moon), [indicator] Note and [indicator] Artifacts · unlock with TL Creds
• 🔒 Beast Affiliate Credential Access - Mimikatz, LaZagne, NirSoft Viewers, Kerberoasting and WDigest Enablement · unlock with TL Creds
• 🔒 Beast Lateral Movement - PsExec Service, Netscan and TCP/445 Subnet Sweep · unlock with TL Creds
• 🔒 Beast Ransomware - Mass Service Stop and Process Kill of Backup, Database, Security and Office Software · unlock with TL Creds
• 🔒 GodDamn / Beast - PoisonX g11.sys Driver and symantec.exe Masquerading Defense Evasion · unlock with TL Creds
• 🔒 Beast Ransomware - [indicator] Beacon, Leak Site and MEGA Exfiltration Tooling · unlock with TL Creds
• 🔒 Beast Ransomware - GUID-Named Run Key Persistence and ProgramData Self-Copy · unlock with TL Creds
• 🔒 Beast / GodDamn - Unsanctioned AnyDesk Unattended Access and Relay Contact · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 36 indicators of compromise for TL-2026-5940.

Sample indicators (3 of 36)

• IP address: 15.235.230[.]188
• Domain: beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd[.]onion
• File hash: 4c44ac1eea4bc7f4ea542d611b5658d7ac2729d79abe750da83f1581cd832eaf

Defanged, TLP:CLEAR. Full set of 36 indicators: unlock with TL Creds.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Symantec and Carbon Black attribute Beast and the Monster family to developer Hyadina, which rebranded as GodDamn per Symantec (July 9, 2026).

Beast is a ransomware-as-a-service (RaaS) platform operated by the developer tracked as Hyadina (Symantec / Carbon Black). Hyadina was first seen in March 2022 deploying Monster (a Delphi-written, 32-bit Windows locker that avoided CIS countries); Monster was rebranded as Beast in June 2024 when Beast was advertised on the RAMP forum. Beast added Linux and VMware ESXi/NAS builds, better encryption performance and more languages (including Chinese). Affiliates produce customized builds with an offline builder, so no active C2 is needed at deployment. Operators run a Tor leak site (BEAST LEAKS) for double extortion. Per Symantec (July 9, 2026), Hyadina rebranded again as GodDamn, which shares significant code with Beast. The latest reported Beast activity is 2026-08-30, and the original leak site remains active.

The analyzed Windows sample (SHA-256 4c44ac1e...832eaf) is an 81 KB 32-bit C/C++ PE compiled 2024-08-09. Strings are built on the stack and XOR-decoded with single-byte key 0x55; a ChaCha20-protected configuration in .data (key and nonce stored immediately before the blob) holds two attacker public keys, exclusion lists, process/service kill lists, the ransom note and the beacon URL. At runtime it creates the mutex 'BEAST HERE?', skips systems whose UI language/locale is AR, AM, AZ, BY, CY, GE, KZ, KG, MD, RU, TJ, TM, UA, UZ or VN, and sends two HTTP beacons (BEGIN before and END after encryption) to an IP-logger URL (iplogger.co/1v1i85.torrent) with the victim ID in the User-Agent and the status in the Referer. Persistence is an HKCU Run value named for the victim GUID; with -I it copies itself to %ALLUSERSPROFILE%\{victim-GUID}\<8 random letters>.exe. It enables SeTakeOwnershipPrivilege, terminates 52 processes and stops 73 services (backup, database, security, office, mail), uses the Windows Restart Manager to release locked files, enumerates Win32_ShadowCopy via WMI and calls DeleteInstance on each (admin required), and empties the Recycle Bin. For lateral reach it reads the ARP cache (GetIpNetTable), keeps private ranges, reduces them to /24 subnets, probes TCP/445 asynchronously, enumerates shares (excluding ADMIN$) and mounts volumes lacking drive letters (-M).

Encryption uses ChaCha20 with Curve25519 ECDH and SHA-512 key/nonce derivation: a per-machine session keypair is protected under two attacker public keys, and each file gets an ephemeral keypair. A 160-byte footer ending in 66 6B EA 57 1A BE 16 66 prevents double encryption. Intermittent encryption processes 128 KiB chunks (default 25%, minimum 3; files >=1 GiB are front-loaded up to 4,096 chunks / 512 MiB). Files are renamed <name>.{<victim-id>}.moon, the note is README.TXT, and a 128-byte default.key sits beside the executable or in %TEMP%. Operators can open a hidden GUI (ALT+CTRL then type 666, -V) to enumerate drives/shares/subnets and start, pause, resume or stop encryption. Command-line switches include -K (kill), -S (shadow copies), -N (network), -M (mount), -P (percentage), -I (self-copy), -A (autorun), -O (offline), -W (drop notes), -Z (ZIP-wrapped output).

Affiliate tradecraft documented by Hive Pro includes phishing (fake copyright-complaint and job-application lures leading to layered archives) and exposed RDP for initial access; credential theft with Mimikatz and LaZagne, WDigest enablement (enable_dump_pass.reg) and Kerberoasting (Kerberos.ps1); PsExec lateral movement; disable_backup.bat for backup/VSS disruption; and pre-encryption exfiltration to MEGA. Symantec's related GodDamn intrusion (May 29 - June 3, 2026) used AnyDesk configured for unattended access, a 14-tool NirSoft/Mimikatz credential toolkit, PsExec, a masquerading symantec.exe that drops the Microsoft-signed PoisonX kernel driver (g11.sys) to kill security products, and the encrypter encrypter-windows-gui-x86.exe. Earlier Hyadina activity used Gmer, Defender Control and IObit Unlocker (June 2025). Reported targeted sectors are broad (manufacturing, healthcare, education, government, financial, IT and others) and regions include the US, UK, Canada, India, South Korea, China, Belgium, Czechia, Denmark, Bolivia and Guatemala. Ransom contacts: vortexecho@zohomail.eu, somran@onionmail.com, Telegram @somran2024. The severity rating is an analyst judgment.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1555.003 Credentials from Password Stores: Credentials from Web Browsers; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1135 Network Share Discovery; T1614.001 System Location Discovery: System Language Discovery

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Execution

T1047 Windows Management Instrumentation; T1569.002 System Services: Service Execution

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1566.001 Spearphishing Attachment

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Persistence

T1543.003 Create or Modify System Process: Windows Service; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• Alert on WMI Win32_ShadowCopy DeleteInstance, vssadmin/wmic shadow deletion and mass service-stop events
• Hunt for HKCU Run values named with a GUID pointing to random 8-letter executables under %ALLUSERSPROFILE%
• Block and alert on outbound traffic to IP-logging domains such as iplogger.co
• Hunt for mutex 'BEAST HERE?', default.key, README.TXT and files ending .{GUID}.moon
• Alert on unsanctioned AnyDesk installs, PsExec service creation and NirSoft credential tools

Workarounds

• Apply driver blocklists (WDAC/HVCI) to stop malicious signed kernel drivers
• Disable WDigest credential caching and monitor enable_dump_pass.reg-style changes

Longer-term hardening

• Maintain offline/immutable backups and test restores
• Segment networks and restrict SMB (TCP/445) between workstations
• Deploy EDR with tamper protection and block loading of known malicious signed drivers (PoisonX g11.sys)
• Enforce MFA and restrict/monitor RDP exposure; use phishing-resistant email filtering for archive lures
• Restrict WMI and remote-admin tooling to approved admin hosts

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows workstations and servers (32-bit PE payload; no specific version restriction stated)
• VMware — ESXi
  Vulnerable versions: Hosts targeted by Beast ESXi builds (Linux/ESXi builds reported by Symantec and Hive Pro)

Timeline

Last updated 2026-11-14 · revalidated 1× · latest source

• 2022-03-01 Hyadina first seen deploying Monster ransomware (March 2022 per Symantec; some outlets say November 2022). Day not stated; first of month used.
• 2024-06-01 Monster rebranded as Beast; RaaS surfaces on the RAMP forum (June 2024; day not stated).
• 2024-08-01 Operators promote an offline builder producing payloads for Windows, NAS devices and VMware ESXi (August 2024; day not stated).
• 2024-08-09 Analyzed 81 KB 32-bit Windows Beast sample compiled (14:52 UTC); builder with Windows, NAS and ESXi payloads promoted in August 2024.
• 2025-06-01 Symantec documents a Beast attack using Gmer, Defender Control and IObit Unlocker (June 2025; day not stated).
• 2025-07-01 Beast Tor-based leak site launches (July 2025 per AhnLab); 16 victims disclosed as of August 2025.
• 2025-10-23 AhnLab ASEC publishes 'The Beast Ransomware Hidden in the GUI' documenting the Ctrl+Alt+666 GUI, five MD5 hashes and the iplogger beacon.
• 2026-05-21 GodDamn, a Beast rebrand sharing significant code, first seen.
• 2026-05-29 AnyDesk appears in the Music folder of the first host, the earliest observed activity in the Symantec-investigated intrusion.
• 2026-05-30 PoisonX driver (g11.sys), the Symantec.exe evasion tool, a credential toolkit and Netscan are deployed on a second host in the GodDamn intrusion.
• 2026-06-01 PsExec lateral movement begins and Defender real-time monitoring is disabled; AnyDesk rolled out to at least 10 hosts on 2026-06-02.
• 2026-06-03 GodDamn ransomware detected on a separate network segment.
• 2026-07-09 Symantec publishes the GodDamn report linking Hyadina, Beast and GodDamn, and documenting the PoisonX driver.
• 2026-08-30 Latest reported Beast activity; the original leak site remains active.
• 2026-10-23 AttackIQ publishes its technical analysis of the Beast Windows encryptor and an emulation.
• 2026-11-13 GBHackers reports on Beast's backup disabling, shadow copy deletion and network drive encryption.

Update history

• 2026-11-14 — Beast Ransomware (RaaS) Uses Hidden '666' Control Panel to Encrypt Windows Systems and Network Shares; Hyadina Rebrand GodDamn Adds PoisonX Driver: What changed No severity, exploitability or status change; existing values (HIGH / ACTIVE) already match the newer report. New indicators (9) Indicator values are withheld at this access level.

Sources cited

• Tracking Beast: Tools, Techniques, and Tradecraft in RaaS Operations (Hive Pro) hivepro.com · Advisory
• Beast Ransomware (AttackIQ) attackiq.com · Research · 2026-10-23
• GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses (Symantec) security.com · Vendor report · 2026-07-09
• THREAT ANALYSIS: Beast Ransomware (Cybereason) cybereason.com · Vendor report
• Dark Web Profile: Beast Ransomware (SOCRadar) socradar.io · Research
• Hyadina actor profile (Malpedia) malpedia.caad.fkie.fraunhofer.de · Research
• Hackers Deploy Beast Ransomware to Disable Backup Services, Delete Shadow Copies, and Encrypt Network Drives (GBHackers) gbhackers.com · News · 2026-11-13
• GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses (The Hacker News) The Hacker News · News · 2026-07-01

More in ransomware

• Pixelleaks (new group) claims data leak from Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (China, healthcare)
• Ransomware Leak-Site Cadence Analysis: INCRANSOM, TheGentlemen and Audit Team Run Active Intrusion Pipelines Amid Group Consolidation
• Vexy Ransomware lists Upper Web (Brazil, Technology) as a victim
• AI-Enabled Ransomware Evolution: Machine-Speed Kill Chains and Initial Access Broker Disruption (TrendAI Assessment, ARTEX Agentic Exploitation Context)
• Everest ransomware leak-site listing: "Final Notice Before Publication" (victim unnamed)

More from Hyadina

• Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses PoisonX Signed Kernel Driver to Disable Endpoint Defenses
• GodDamn Ransomware (Hyadina) — Third Rebrand from Monster/Beast, Deploys Signed PoisonX Kernel Driver

Previous and next in ransomware

• Vexy Ransomware lists Osiiminppal on leak site (100 MB claimed exfiltration) Previous report
• ESXi/vCenter Ransomware Destroys Virtualization Estate via Legitimate Management Features (BlackNevas/Trigona-linked) Next report