Beast Ransomware Uses Hidden ‘666’ Control Panel to Encrypt Windows Systems and Network Shares

Beast ransomware has a hidden control panel. An attacker who presses ALT+CTRL and types 666 on an infected Windows machine opens a graphical interface that lets them choose what to encrypt.

Most ransomware runs from the command line, so this gives affiliates (the criminals who rent the tool) much more hands-on control during an infection.

Beast is a Ransomware-as-a-Service (RaaS) operation that appeared on the RAMP underground forum in June 2024. It is reportedly the successor to Monster ransomware, which was sold on the same forum in March 2022.

In August 2024, its operators began promoting an offline builder that creates payloads for Windows, NAS devices and VMware ESXi servers. Earlier Beast ransomware multi-OS attacks showed how quickly the group adapts to new platforms.

Researchers at AttackIQ analyzed the malware in a report published on October 23, 2026. They reverse-engineered a 32-bit Windows sample and mapped its behavior.

Symantec and Carbon Black link Beast to an actor called Hyadina. In July 2026, Symantec reported that the group had returned under the name GodDamn Ransomware, which shares a lot of code with Beast. The original Beast leak site is still active, and the latest reported activity dates to August 30, 2026.

Beast Ransomware Uses Hidden ‘666’ Control Panel

The panel shows the attacker every local drive, network share and reachable subnet. The attacker picks the targets and can start, pause, resume, stop or reset the encryption while watching its progress live.

This lets them adjust the job to each victim instead of encrypting everything blindly. The malware also accepts command-line flags that override its built-in settings.

These flags can turn on network discovery, kill security processes, delete shadow copies, empty the Recycle Bin, or wrap each file in a ZIP container that holds the ransom note.

When it starts, Beast creates a mutex named “BEAST HERE?” so only one copy runs at a time. It skips machines in the CIS region and several other countries, based on the system language.

Persistence comes from a Run key in the current user’s registry, which needs no admin rights. To reach network shares, Beast reads the ARP cache for nearby hosts. It narrows them to private subnets and probes TCP port 445.

It then lists the shares on every host that answers, skips ADMIN$, and queues the rest for encryption. It also mounts hidden volumes that have no drive letter.

Before encrypting, Beast stops 52 processes and 73 services, including backup tools, databases and security software.

If a file is still locked, it uses Windows Restart Manager exploitation to close the program holding it. With admin rights, it also deletes Volume Shadow Copies through WMI, which removes the easiest way to restore files.

Encryption Design and Recovery Problems

Beast encrypts files with ChaCha20 and protects the keys with Curve25519. Every file gets its own key pair. The victim’s session key is locked twice, once with each of two attacker public keys, and it is saved in a 128-byte file named default.key.

Each encrypted file also gets a 160-byte footer that ends with the marker 66 6B EA 57 1A BE 16 66. Beast uses the marker to skip files it has already processed.

To save time, Beast uses the intermittent encryption technique seen in other ransomware. It splits files into 128 KiB chunks and encrypts only a share of them.

The analyzed build was set to 25%, with a minimum of three chunks, so small files end up fully encrypted. On files of 1 GiB or more, it encrypts alternating chunks from the start and stops at 512 MiB.

A large database or backup file is therefore damaged at the front while the rest stays untouched, which still usually leaves it unusable.

Encrypted files are renamed to the original name plus the victim ID and an extension, which was .moon in this sample. A README.TXT ransom note is dropped, and the note lists contact details for the attackers.

The malware also contacts a public IP-logging URL twice, once before encryption starts and once after it ends. The victim ID travels in the User-Agent header, and the Referer field says BEGIN or END. This tells the attacker that the job started and roughly how long it took.

Defenders should watch for WMI shadow copy deletion, mass service stops, and bursts of SMB scanning on port 445. Backups must be kept offline, because groups that disable EDR and backups before encrypting are a growing pattern.

Blocking the IoCs below and limiting admin rights will also help. AttackIQ has released an emulation of Beast so teams can test whether their controls catch it.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Beast Ransomware Uses Hidden ‘666’ Control Panel to Encrypt Windows Systems and Network Shares appeared first on Cyber Security News.