Beast Ransomware Employs Backup Disabling, Shadow Copy Deletion, and Partial Encryption to Evade Recovery
The Beast ransomware, linked to the threat actor tracked as Hyadina (rebranded as GodDamn), delivers a sophisticated payload enabling affiliates to interact via a graphical console and override embedded defaults. It aggressively disrupts recovery by killing backup-related services, deleting shadow copies using WMI (requiring administrative privileges), and clearing the Recycle Bin prior to encrypting files. Encryption uses a careful partial-file scheme to speed execution and limit damage to large files, encrypting 25% of chunks or capping damage at 512 MiB for files over 1 GiB. The malware also performs network reconnaissance using ARP-driven SMB share enumeration, targeting connected hosts on the local subnet for network-wide encryption spread. Communication with a command-and-control infrastructure uses IP logging services to signal job start and completion. Persistent execution is maintained via registry run keys with randomized names. The malware skips systems with locales in the CIS and other countries. Detection defense recommendations include alerting on WMI shadow-copy deletion, mass service termination, suspicious ARP-based SMB scanning, and presence of suspicious run keys. AttackIQ provides an emulation tool for testing defenses against Beast's attack chain.
Linha do tempo
-
Beast Ransomware Employs Backup Disabling, Shadow Copy Deletion, and Partial Encryption to Evade Recovery
ler a análise desta fonte ocultar
The Beast ransomware, linked to the threat actor tracked as Hyadina (rebranded as GodDamn), delivers a sophisticated payload enabling affiliates to interact via a graphical console and override embedded defaults. It aggressively disrupts recovery by killing backup-related services, deleting shadow copies using WMI (requiring administrative privileges), and clearing the Recycle Bin prior to encrypting files. Encryption uses a careful partial-file scheme to speed execution and limit damage to large files, encrypting 25% of chunks or capping damage at 512 MiB for files over 1 GiB. The malware also performs network reconnaissance using ARP-driven SMB share enumeration, targeting connected hosts on the local subnet for network-wide encryption spread. Communication with a command-and-control infrastructure uses IP logging services to signal job start and completion. Persistent execution is maintained via registry run keys with randomized names. The malware skips systems with locales in the CIS and other countries. Detection defense recommendations include alerting on WMI shadow-copy deletion, mass service termination, suspicious ARP-based SMB scanning, and presence of suspicious run keys. AttackIQ provides an emulation tool for testing defenses against Beast's attack chain.