GoKawiilAn open server hosted on a German cloud provider's systems has been discovered, containing the entire toolset of a member of the Beast ransomware group. The find exposes the tactics, techniques, and procedures of the threat actor, but also reveals that Beast shares many of those TTPs with other ransomware gangs.
According to threat-intelligence firm Team Cymru, the ransomware toolset includes those used for reconnaissance, network mapping, credential theft, and exfiltration, as well as techniques for persistence and moving laterally through the local environment.
Many of the tools, such as AnyDesk for remote management and Mega for downloads, have both legitimate and malicious uses — and those tools are commonly used by many ransomware groups, says Will Thomas, senior threat intelligence advisor for Team Cymru.
"The way that a lot of ransomware groups operate is, they're reusing a lot of the tools that other ransomware groups use," he says. "For many companies, it is not as hard as it seems to actually defend against [these attacks], because as long as you have the right protections in place to block these [tools] from being able to run on your systems, they're not going to be able to hit you."
Related:Interlock Ransomware Targets Cisco Enterprise Firewalls
Ransomware continues to be a persistent problem, albeit one with which companies are slowly coming to grips. In 2025, only half of attacks resulted in encryption, the lowest in six years and down from a high of 70% in 2024, according to Sophos' "The State of Ransomware 2025" report. Yet, 49% of organizations affected by an attack paid the ransom, the second highest in six years, the report found.
The Beast ransomware group is a fairly new one, which sprung from another strain — the so-called Monster ransomware gang. It announced itself in 2024, and began operations as a ransomware-as-a-service (RaaS) scheme in February 2025, launching a data-leak site in July.
The group is known for using tools to find and delete backups, and to stop security- and backup-related processes. Beast terminates processes that have to do with "databases, backup and recovery, antivirus products, Office, file editors, and emails," threat-intelligence researchers from South Korea-based AhnLabs stated in an October analysis of the group.
"Beast ransomware goes beyond simple file encryption and employs a complex attack method that combines structural recovery prevention techniques and data exfiltration," AhnLab researchers stated. "As such, establishing an early detection and rapid response system is crucial."
Related:EU Sanctions Companies in China, Iran for Cyberattacks
... continue reading