BEAST

Beast refers to two distinct malware families in the provided content. Most prominently, Beast is described as a ransomware-as-a-service (RaaS) operation and ransomware family that emerged from the Monster ransomware strain, announced itself in 2024, began RaaS operations in February 2025, and launched a data-leak site in July 2025. It is described as active since at least 2022 in some reporting and supports multi-platform payloads for Windows, Linux, and VMware ESXi. Reported intrusion vectors include compromised RDP, SMB scanning, and opportunistic exploitation. Beast is associated with double-extortion behavior, including data exfiltration and file encryption, and has been reported using ChaCha20 encryption. Multiple sources state that it aggressively impairs recovery by locating and deleting backups, including Microsoft Windows Volume Shadow Copy Service data, stopping the VSS service, and terminating processes related to databases, backup and recovery, antivirus products, Microsoft Office, file editors, email, and other security- or backup-related software. Team Cymru reported an exposed server containing a Beast operator’s toolset, including reconnaissance, network mapping, credential theft, exfiltration, persistence, and lateral movement tooling, with AnyDesk and Mega specifically identified; Mega was noted as used for exfiltration. Files observed on that server included disable_backup.bat, designed to delete VSS backups and stop the VSS service, and CleanExit.exe, assessed as likely intended to wipe logs after ransomware execution. A mutex string "BEAST HERE?" is also listed in reporting. Victim reporting in the content includes attacks against healthcare organizations, a South Korean pharmaceutical company, and a South Korean battery safety component manufacturer.

Separately, the content also identifies Beast as an older Windows-based backdoor trojan / remote administration tool (RAT) developed by Tataye, first released in 2002 and last listed as version 2.07 on August 3, 2004. That Beast RAT was written in Delphi, targeted Windows 95 through Windows XP, used a client-server architecture, and was noted as one of the early trojans to use reverse connections. After execution, it reportedly used code injection into other applications and gave an attacker complete control of the infected system. Because current security-professional usage in the supplied content is dominated by the ransomware family, "Beast" is most likely to refer to the ransomware operation unless historical RAT context is explicitly intended.