# Beast Ransomware (RaaS) Disables Backup Services, Deletes Shadow Copies, and Encrypts Network Drives

> Beast is a ransomware-as-a-service operation that surfaced on the RAMP forum in June 2024 and is reportedly the successor to Monster. Its Windows payload stops 52 processes and 73 services, deletes shadow copies via WMI, discovers SMB hosts and shares, and encrypts files with ChaCha20 using a Curve25519 key hierarchy. Symantec and Carbon Black attribute Beast and the Monster family to developer Hyadina, which rebranded as GodDamn per Symantec (July 9, 2026).

- **Published:** 2026-11-13T07:39:02Z
- **Last reviewed:** 2026-11-14T00:11:58.771Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5940
- **ID:** TL-2026-5940
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Hyadina
- **Detections:** 9 (1 shown free below) · **IOCs:** 36 (3 shown free below)

## Description

Beast is a ransomware-as-a-service (RaaS) platform operated by the developer tracked as Hyadina (Symantec / Carbon Black). Hyadina was first seen in March 2022 deploying Monster (a Delphi-written, 32-bit Windows locker that avoided CIS countries); Monster was rebranded as Beast in June 2024 when Beast was advertised on the RAMP forum. Beast added Linux and VMware ESXi/NAS builds, better encryption performance and more languages (including Chinese). Affiliates produce customized builds with an offline builder, so no active C2 is needed at deployment. Operators run a Tor leak site (BEAST LEAKS) for double extortion. Per Symantec (July 9, 2026), Hyadina rebranded again as GodDamn, which shares significant code with Beast. The latest reported Beast activity is 2026-08-30, and the original leak site remains active.

The analyzed Windows sample (SHA-256 4c44ac1e...832eaf) is an 81 KB 32-bit C/C++ PE compiled 2024-08-09. Strings are built on the stack and XOR-decoded with single-byte key 0x55; a ChaCha20-protected configuration in .data (key and nonce stored immediately before the blob) holds two attacker public keys, exclusion lists, process/service kill lists, the ransom note and the beacon URL. At runtime it creates the mutex 'BEAST HERE?', skips systems whose UI language/locale is AR, AM, AZ, BY, CY, GE, KZ, KG, MD, RU, TJ, TM, UA, UZ or VN, and sends two HTTP beacons (BEGIN before and END after encryption) to an IP-logger URL (iplogger.co/1v1i85.torrent) with the victim ID in the User-Agent and the status in the Referer. Persistence is an HKCU Run value named for the victim GUID; with -I it copies itself to %ALLUSERSPROFILE%\{victim-GUID}\<8 random letters>.exe. It enables SeTakeOwnershipPrivilege, terminates 52 processes and stops 73 services (backup, database, security, office, mail), uses the Windows Restart Manager to release locked files, enumerates Win32_ShadowCopy via WMI and calls DeleteInstance on each (admin required), and empties the Recycle Bin. For lateral reach it reads the ARP cache (GetIpNetTable), keeps private ranges, reduces them to /24 subnets, probes TCP/445 asynchronously, enumerates shares (excluding ADMIN$) and mounts volumes lacking drive letters (-M).

Encryption uses ChaCha20 with Curve25519 ECDH and SHA-512 key/nonce derivation: a per-machine session keypair is protected under two attacker public keys, and each file gets an ephemeral keypair. A 160-byte footer ending in 66 6B EA 57 1A BE 16 66 prevents double encryption. Intermittent encryption processes 128 KiB chunks (default 25%, minimum 3; files >=1 GiB are front-loaded up to 4,096 chunks / 512 MiB). Files are renamed <name>.{<victim-id>}.moon, the note is README.TXT, and a 128-byte default.key sits beside the executable or in %TEMP%. Operators can open a hidden GUI (ALT+CTRL then type 666, -V) to enumerate drives/shares/subnets and start, pause, resume or stop encryption. Command-line switches include -K (kill), -S (shadow copies), -N (network), -M (mount), -P (percentage), -I (self-copy), -A (autorun), -O (offline), -W (drop notes), -Z (ZIP-wrapped output).

Affiliate tradecraft documented by Hive Pro includes phishing (fake copyright-complaint and job-application lures leading to layered archives) and exposed RDP for initial access; credential theft with Mimikatz and LaZagne, WDigest enablement (enable_dump_pass.reg) and Kerberoasting (Kerberos.ps1); PsExec lateral movement; disable_backup.bat for backup/VSS disruption; and pre-encryption exfiltration to MEGA. Symantec's related GodDamn intrusion (May 29 - June 3, 2026) used AnyDesk configured for unattended access, a 14-tool NirSoft/Mimikatz credential toolkit, PsExec, a masquerading symantec.exe that drops the Microsoft-signed PoisonX kernel driver (g11.sys) to kill security products, and the encrypter encrypter-windows-gui-x86.exe. Earlier Hyadina activity used Gmer, Defender Control and IObit Unlocker (June 2025). Reported targeted sectors are broad (manufacturing, healthcare, education, government, financial, IT and others) and regions include the US, UK, Canada, India, South Korea, China, Belgium, Czechia, Denmark, Bolivia and Guatemala. Ransom contacts: vortexecho@zohomail.eu, somran@onionmail.com, Telegram @somran2024. The severity rating is an analyst judgment.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1133 External Remote Services
- T1078 Valid Accounts
- T1047 Windows Management Instrumentation
- T1569.002 System Services: Service Execution
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1543.003 Create or Modify System Process: Windows Service
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1003.001 OS Credential Dumping: LSASS Memory
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1614.001 System Location Discovery: System Language Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1219 Remote Access Tools
- T1071.001 Application Layer Protocol: Web Protocols
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1140 Deobfuscate/Decode Files or Information

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Beast Ransomware - Shadow Copy / Backup Destruction (WMI Win32_ShadowCopy, vssadmin, wbadmin, disable_backup.bat)** (`TL-2026-5940-SPL-001`)

Beast (TL-2026-5940, Hyadina RaaS, rebrand GodDamn) enumerates Win32_ShadowCopy through WMI and calls DeleteInstance before encrypting, and affiliates run disable_backup.bat to wreck backups and VSS. This behaviour-first search catches the command-line forms of that recovery inhibition (T1490), including WMI-based deletion (T1047), in Sysmon process creation. Native in-process DeleteInstance calls by the encryptor itself need WMI-Activity telemetry, so pair this with the file-artifact and service-stop detections.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1047
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
( (Image="*vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*")
OR (Image="*wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*")
OR (Image="*wbadmin.exe" CommandLine="*delete*" (CommandLine="*catalog*" OR CommandLine="*backup*" OR CommandLine="*systemstatebackup*"))
OR (Image="*bcdedit.exe" CommandLine="*recoveryenabled*" CommandLine="*no*")
OR ((Image="*powershell.exe" OR Image="*pwsh.exe") CommandLine="*Win32_ShadowCopy*" (CommandLine="*Delete*" OR CommandLine="*Remove-CimInstance*" OR CommandLine="*DeleteInstance*"))
OR CommandLine="*disable_backup.bat*" )
| eval technique="T1490 Inhibit System Recovery", wmi_path=if(like(CommandLine,"%Win32_ShadowCopy%") OR like(Image,"%wmic.exe"),"T1047 WMI","none")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(technique) as technique values(wmi_path) as wmi_path by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete" and ProcessCommandLine has_any ("catalog", "backup", "systemstatebackup"))
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled" and ProcessCommandLine has "no")
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Win32_ShadowCopy" and ProcessCommandLine has_any ("Delete", "Remove-CimInstance", "DeleteInstance"))
    or ProcessCommandLine has "disable_backup.bat"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Beast Ransomware Shadow Copy and Backup Destruction (TL-2026-5940)
id: 7c1d3f52-9a4e-4b61-8d2a-5e0b1c7a3f01
status: experimental
description: Detects Beast and GodDamn style recovery inhibition using vssadmin, wmic, wbadmin, bcdedit and PowerShell Win32_ShadowCopy deletion plus the affiliate disable_backup.bat script.
references:
    - https://www.attackiq.com/2026/10/23/beast-ransomware/
    - https://www.security.com/blog-post/goddamn-ransomware-beast-rebrand
    - https://www.hivepro.com/threat-advisory/tracking-beast-tools-techniques-and-tradecraft-in-raas-operations
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.impact
    - attack.t1490
    - attack.execution
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_wbadmin_catalog:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'catalog'
    selection_wbadmin_backup:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'backup'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains|all:
            - 'recoveryenabled'
            - 'no'
    selection_ps_delete:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Win32_ShadowCopy'
            - 'Delete'
    selection_ps_cim:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Win32_ShadowCopy'
            - 'Remove-CimInstance'
    selection_script:
        CommandLine|contains: 'disable_backup.bat'
    condition: 1 of selection_*
falsepositives:
    - Backup software or admins legitimately pruning shadow copies
    - Disk cleanup or imaging scripts that run vssadmin delete shadows
level: high

```

**Known false positives:**

- Backup or imaging products that legitimately delete shadow copies or catalogs during maintenance
- Administrators running vssadmin delete shadows to reclaim disk space

**Tuning notes:** Allow-list known backup servers and admin jump hosts by host and ParentImage. Raise to critical when the same host also shows service-stop bursts (SIG-001) or .moon file creation (KQL-001) within 30 minutes. Enable Microsoft-Windows-WMI-Activity/Operational (EID 5857/5861) to see in-process Win32_ShadowCopy DeleteInstance calls.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Beast Ransomware - Encrypted File (.{GUID}.moon), [indicator] Note and [indicator] Artifacts (locked: unlock with TL Creds)
- Beast Affiliate Credential Access - Mimikatz, LaZagne, NirSoft Viewers, Kerberoasting and WDigest Enablement (locked: unlock with TL Creds)
- Beast Lateral Movement - PsExec Service, Netscan and TCP/445 Subnet Sweep (locked: unlock with TL Creds)
- Beast Ransomware - Mass Service Stop and Process Kill of Backup, Database, Security and Office Software (locked: unlock with TL Creds)
- GodDamn / Beast - PoisonX g11.sys Driver and symantec.exe Masquerading Defense Evasion (locked: unlock with TL Creds)
- Beast Ransomware - [indicator] Beacon, Leak Site and MEGA Exfiltration Tooling (locked: unlock with TL Creds)
- Beast Ransomware - GUID-Named Run Key Persistence and ProgramData Self-Copy (locked: unlock with TL Creds)
- Beast / GodDamn - Unsanctioned AnyDesk Unattended Access and Relay Contact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 36)

Defanged, TLP:CLEAR.

- IP address: `15.235.230[.]188`
- Domain: `beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd[.]onion`
- File hash: `4c44ac1eea4bc7f4ea542d611b5658d7ac2729d79abe750da83f1581cd832eaf`

Full set of 36 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Deploy Beast Ransomware to Disable Backup Services, Delete Shadow Copies, and Encrypt Network Drives (GBHackers)](https://gbhackers.com/beast-ransomware-attack/)
- [Beast Ransomware (AttackIQ)](https://www.attackiq.com/2026/10/23/beast-ransomware/)
- [GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses (Symantec)](https://www.security.com/blog-post/goddamn-ransomware-beast-rebrand)
- [Tracking Beast: Tools, Techniques, and Tradecraft in RaaS Operations (Hive Pro)](https://www.hivepro.com/threat-advisory/tracking-beast-tools-techniques-and-tradecraft-in-raas-operations)
- [THREAT ANALYSIS: Beast Ransomware (Cybereason)](https://www.cybereason.com/blog/threat-analysis-beast-ransomware)
- [Dark Web Profile: Beast Ransomware (SOCRadar)](https://socradar.io/dark-web-profile-beast-ransomware/)
- [GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses (The Hacker News)](https://thehackernews.com/2026/07/goddamn-ransomware-uses-poisonx-driver.html)
- [Hyadina actor profile (Malpedia)](https://malpedia.caad.fkie.fraunhofer.de/actor/hyadina)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5940