Beast — Ransomware Profile

Beast is a ransomware-as-a-service offering rather than a single crew, licensed to affiliates who run their own intrusions. Cybereason's October 2024 analysis traced it back to 2022 and to an earlier Delphi-written family called Monster, with the current Windows build rewritten in C and companion encryptors produced for Linux (in C and Go) and VMware ESXi, the latter able to shut guest VMs down before encrypting them. Cybereason recorded the operators advertising a partnership program on underground forums in mid-2024 and, by that August, shipping an offline builder that let affiliates tailor their own binaries. Technically the payload pairs elliptic-curve cryptography with ChaCha20, encrypts files in segments across multiple threads for speed, deletes shadow copies, sweeps SMB shares to locate further hosts, and stops services and processes that would otherwise hold files open — prioritizing backups, databases and enterprise applications. It also inspects default language and country settings and skips machines that resolve to CIS states, a geofence typical of ransomware built by Russian-speaking developers. Malpedia additionally records the family under the name blacklockbit.

Also tracked as

GIGAKICK

IntelFusions coverage (1)

Recent claimed victims

Vendor research

Read the full analysis on IntelFusions