Threat Intelligence Report July 29 - August 4 2025

Beast Ransomware

Beast is a Tor-centric, double-extortion ransomware operation that surfaced prominently in early 2025 and has rapidly evolved into a low-noise but high-impact actor. Unlike many traditional ransomware groups, Beast avoids clear-web infrastructure, instead favouring onion-based leak sites and peer-to-peer negotiation channels. This tactic not only complicates attribution but also circumvents typical domain and IP-based detections.

Affiliates deploy the malware manually or semi-automatically, often executing encryption and exfiltration without persistent C2 beaconing. This infrastructure-minimal model suggests a preference for stealth over scale, drawing parallels to emerging “offline” ransomware families.

Detailed TTPs

Below is a refined breakdown of Beast’s observed Tactics, Techniques & Procedures (TTPs). 

Initial Access

Valid Accounts (T1078)
Beast affiliates gained access via brute-forced or previously leaked RDP/SSH credentials, frequently targeting misconfigured Linux and Windows servers.

Execution

Command and Scripting Interpreter (T1059)
Malware payloads were manually launched or dropped via bash or PowerShell one-liners that initiated encryption and loaded auxiliary tools.

Persistence

Boot or Logon Initialisation Scripts (T1037.004)
On Linux systems, a persistence mechanism was set via /etc/profile.d/beast.sh, which silently executed on every shell session.
Windows targets employed scheduled tasks and      HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Defence Evasion

Obfuscated Files or Information (T1027)
Beast’s ELF payloads were UPX-packed and used filename padding (.log, .conf) to blend with legitimate configuration files.

Credential Access

Credential Dumping (T1003)
Harvesting of /etc/shadow (Linux) and LSASS memory (Windows) was performed using open-source tooling like mimit or nanodump.

Discovery

System Information Discovery (T1082)
The malware probed hostnames, disk space, mounted volumes, and user lists using uname, df -h, and whoami to triage target environments.

Lateral Movement

Remote Services (SSH) (T1021.002)
Using captured credentials, the malware propagated laterally via SSH to additional reachable systems inside the 10.x/192.168.x IP ranges.

Collection & Exfiltration

Archive Collected Data (T1560.001)
Data was compressed via tar and zip, and staged in /tmp/.beast/ before transfer.

Exfiltration Over Alternative Protocol (T1048)
Stolen data was exfiltrated over custom SSH tunnels to attacker the infrastructure or uploaded to Tor-based drop servers.

Phase	Technique	ATT&CK ID
Initial Access	Valid Accounts	T1078
Execution	Command and Scripting Interpreter	T1059
Persistence	Logon Initialisation Scripts	T1037.004
Defence Evasion	Obfuscated Files/Information	T1027
Credential Access	Credential Dumping	T1003
Discovery	System Information Discovery	T1082
Lateral Movement	Remote Services (SSH)	T1021.002
Collection	Archive Collected Data	T1560.001
Exfiltration	Exfiltration Over Alt. Protocol	T1048
Impact	Data Encrypted for Impact	T1486

IOCs

• 144.91.79.54

• beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd.onion
   

• ooie6tet7ggcmlgvtmyvok4s6vha6ecwczssbchbyxrg2r6v2m6zkkad.onion ( File Server)

Mail IDs.

TOX ID

92E5D1A8ECFC69E7967E7A9DC1C9A735CD8DCE965D12EF01F19966C7101EAF071B4CDEA310E9

Concise Mitigation with CE 5.0

Email & Sandbox

• Quarantine inbound ZIP/TAR/ISO archives containing ELF or EXE binaries.
• Block DNS/TLS connections to .onion domains and associated Tor proxy gateways.

Endpoint Protection

• HIPS: Alert on new files in /etc/profile.d/, .bashrc, or HKCU\Run.
• Monitor for tools like rclone, scp, mimit, and abnormal lsass.exe access.

Network Controls

• IPS/IDS: Block outbound SSH traffic on non-standard ports (e.g., 2222).
• Sinkhole known Beast onion URLs; monitor Tor process invocation.

Access Management

• Enforce MFA on all exposed SSH/RDP services.
• Alert on first-time access from foreign ASN/IPs or impossible logins.

Backup & Recovery

• Implement immutable, offline backups rotated daily.
• Simulate restore events every 30 days for incident readiness.

Ransomware Victims Worldwide

The United States continues to be the most heavily impacted country by ransomware, accounting for a dominant 59.06% of all reported incidents this week. Its vast digital infrastructure and concentration of high-value industries make it the most consistent target for both well-known and emerging threat actors.

The United Kingdom follows at 6.3%, remaining one of the top European targets due to its advanced economy, reliance on digital services, and global business ties.

Spain and Germany both registered 3.94%, reflecting a persistent threat landscape in Western Europe where professional services, manufacturing, and public sectors are frequently affected.

Italy came in at 3.15%, with Australia and Canada following at 2.36% each—highlighting ransomware’s expanding reach into both Asia-Pacific and North American regions beyond the U.S.

A mid-tier of countries—including Thailand, Netherlands, Turkey, Brazil, and Belgium—each experienced 1.57% of incidents, suggesting continued threat actor interest across diverse geographies.

The long tail includes multiple nations that each reported 0.79% of attacks:
Mexico, Greece, Jordan, Ireland, Argentina, Poland, Lebanon, Singapore, Malaysia, Denmark, France, Bolivia, Colombia, and Guyana. This reflects the increasingly global distribution of ransomware activity, where threat actors cast a wide net, often exploiting opportunistic or low-barrier entry points across industries and regions.