A newly discovered twist in ransomware behavior has emerged: Beast, a Ransomware-as-a-Service group, includes a hidden control panel triggered on Windows systems via pressing ALT+CTRL and typing “666.” This GUI allows attackers to select which drives, network shares, or subnets to encrypt—giving far greater precision than the usual full-blast attacks.
What Beast Ransomware Does Differently
Instead of launching from the command line like most ransomware, Beast’s control panel gives affiliates hands-on control during an infection. Operators can start, stop, pause, resume, or reset the encryption, and watch its progress in real time. The malware also supports command-line flags for enabling network discovery, disabling security tools and shadow copy protections, emptying Recycle Bins, or even wrapping files in ZIP containers that hold ransom notices.
Persistence is achieved without admin privileges via a Run key in the current user’s registry. For reaching network shares, Beast scans the ARP cache, limits its scope to private subnets, and probes TCP port 445. It targets accessible shares—excluding ADMIN$—and even mounts hidden volumes without drive letters.
Encryption Design & Recovery Challenges
Beast encrypts using ChaCha20, with key protection handled via Curve25519. Each file receives its own key pair. The session key is then encrypted twice—once per attacker public key—and stored in a file titled default.key. Encrypted files get a 160-byte footer, including a unique marker identifying files already processed.
To speed up operations, Beast uses intermittent encryption, where only portions of files are altered. In the analyzed sample, it encrypts just 25% of each file with a minimum of three chunks, and for large files (1 GiB or more), it encrypts alternating segments from the beginning up to 512 MiB. While parts beyond that remain intact, damage at the front of big files often renders them unusable.
Each encrypted file is renamed to include a victim ID and a .moon extension, and a ransom note is dropped. The malware also reports back to attackers when it begins and finishes—with HTTP requests that include the victim ID in the User-Agent header and specify “BEGIN” or “END” in the Referer header.
Origins & Actor Links
Beast appeared on the RAMP forum in June 2024 and is a perceived successor to Monster ransomware, which surfaced in March 2022 on the same forum. In August 2024 operators released an offline builder to build payloads for Windows, NAS appliances, and VMware ESXi servers. Security researchers link Beast to the actor “Hyadina,” who may have rebranded to “GodDamn Ransomware” in mid-2026; code overlap between the two has been noted. Traces of Beast remain active, with operations continuing as recently as late August 2026.
Indicators & Defense Strategies
Key indicators include a mutex named BEAST HERE?, encrypted files with the .moon extension, a file footer marker 66 6B EA 57 1A BE 16 66, and a dropped default.key file. Registry persistence through HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, efforts to disable security-related services, SMB scanning on port 445, and deletion of shadow copies via WMI are additional red flags.
Mitigation includes limiting administrative privileges, blocking known indicators of compromise, keeping offline backups, and deploying visibility tools. AttackIQ has published an emulation of Beast’s behavior so that organizations can test whether their detection systems—EDR, SOC workflows, network monitoring—catch this threat proactively.
Beast’s arrival with this level of granularity reflects a troubling evolution in ransomware. The ability to fine-tune what gets encrypted and when shifts the risk landscape: mass attacks are no longer one-size-fits-all. For defenders, that means curating defenses around more subtle clues—shadow copy deletion, erratic service terminations, sudden SMB scans—rather than just loud, broad indicators. The real danger is in what gets quietly skipped and what gets taken: paying attention to smaller signals might now be the difference between containment and compromise.
