Beast Ransomware
Beast Ransomware is a Russia-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 12 sectors, including Technology and Manufacturing, in 29 countries, including the United States and the United Kingdom. It uses 34 MITRE ATT&CK techniques.
- Monster Ransomware
- Origin
- Russia
- Techniques
- 34
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
About Beast Ransomware.
Beast is a financially motivated ransomware operation that evolved from the earlier Monster ransomware strain and re-launched as a Ransomware-as-a-Service (RaaS) in February 2025, with a Tor-based data leak site going live that July. Operating through an affiliate model, where individual partners run their own negotiations and email channels, the group has hit organizations across the U.S., Europe, Asia, and Latin America, primarily small and mid-sized businesses in sectors like manufacturing, construction, healthcare, business services, education, and retail. Affiliates typically gain entry through phishing lures disguised as copyright-infringement notices or fake job applications (often paired with the Vidar infostealer for credential harvesting), then move laterally by scanning for open SMB ports and abusing legitimate tools such as AnyDesk, PsExec, OpenSSH, and WinSCP. Once inside, Beast deletes shadow copies, exfiltrates data using MEGASync, and encrypts files with a hybrid ChaCha20 scheme tied to a public key embedded in the binary, making decryption effectively impossible without the operator's private key, a classic double-extortion playbook backed by leak-site pressure.
Last updated Jun 18, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.