Beast / GodDamn Ransomware Decryption & Data Recovery

Beast is not a sudden newcomer but the third brand of one developer. Symantec tracks that developer as Hyadina, with ransomware activity going back to at least March 2022. The first product, Monster, was written in Delphi and targeted only 32-bit Windows. In June 2024 it became Beast, adding Linux and VMware ESXi support, more interface languages (including Chinese) and faster encryption. GodDamn, first seen on 21 May 2026, is the latest rebrand; Symantec found substantial code overlap with Beast. All three generations deliberately avoid targets in CIS countries.

Beast runs as ransomware-as-a-service. According to Cyber Security News reporting in October 2025, its Tor leak site went live in July 2025 and by August had listed 16 victims across the US, Europe, Asia and Latin America in manufacturing, construction, healthcare, business services and education. A single victim receives negotiation messages from different affiliates, which points to several affiliates deploying the payload.

Why organisations in China should care. 360's August 2026 ransomware report lists Beast (search keyword God8Dam) among the families active in China, spreading through "vulnerability exploitation and database password brute force followed by manual deployment". That mirrors the playbook of China-prevalent families such as Mallox and Weaxor: any organisation with an internet-exposed database service and weak credentials is in range.

Extension. In some attacks GodDamn appends .God8Damn; in the incident Symantec investigated, the operators used the victim organisation's own name as the extension. An extension that is your company's name is therefore a strong signal in itself, and searching the web for it usually returns nothing.

Ransom note. Under the Beast brand the note is README.txt, written into every encrypted directory from the encryptor's embedded configuration. No GodDamn note filename has been published; contact is by email or qTox.

Host-side indicators.

• The mutex BEAST HERE? (recorded by Cybereason) prevents a second instance.
• Pressing ALT+CTRL and typing 666 during encryption brings up the encryptor's interface.
• In the GodDamn incident an encryptor named encrypter-windows-gui-x86.exe sat in users' Downloads and Music folders.
• A file named symantec.exe in the Music folder dropped the PoisonX driver into the driver store as g11.sys.
• AnyDesk was configured for unattended access and registered as two auto-start services.

Bottom line. A .God8Damn or company-name extension, README.txt or a qTox contact, and traces such as AnyDesk and g11.sys together point strongly to this family. Because the extension is not fixed, confirm against encrypted samples and the note.

Entry in China (360). Vulnerability exploitation, and database password brute force followed by manual deployment. Servers with database ports exposed to the internet and weak or default credentials are at highest risk.

Entry elsewhere (ASEC and Cybereason). Phishing emails posing as copyright-infringement notices or job applications, some also dropping the Vidar infostealer to harvest credentials first; and compromised RDP endpoints.

Post-compromise tooling (Symantec's reconstruction of a GodDamn incident).

• AnyDesk configured for unattended access as persistent remote control.
• Mimikatz plus 13 other credential-theft tools, mostly NirSoft-based, covering browsers, Credential Manager, VNC, email, Wi-Fi and network traffic.
• Netscan for internal reconnaissance and PsExec for lateral movement.
• Windows Defender real-time protection disabled.
• The PoisonX kernel driver to blind security software (see "Encryption").

That incident's timeline is typical: AnyDesk first appeared on 29 May, PoisonX and the credential toolkit landed on a second host on 30 May, lateral movement began on 1 June, AnyDesk was on at least 10 hosts by the end of 2 June, and the encryptor was detected on a separate network segment on 3 June. About five days separated the first trace from encryption - that is the window for detection and containment.

Spread inside the network. The encryptor scans for active SMB ports and tries to encrypt any reachable shared folders, with no further user interaction and no external C2 traffic.

Algorithms. Cybereason records a hybrid elliptic-curve plus ChaCha20 scheme. Encryption is multithreaded, with a parent thread handing files to worker threads. Before encrypting, the sample uses the Windows Restart Manager (RstrtMgr.dll) to release file locks so files in use can be encrypted.

Shadow copy deletion. It queries Win32_ShadowCopy over WMI and calls DeleteInstance on each one, so Windows "Previous Versions" cannot be relied on.

Linux and ESXi. Beast ships Linux and ESXi builds with customisable encryption paths and options to shut down virtual machines, plus an offline builder for Windows, NAS and ESXi payloads. When a hypervisor is hit, entire virtual machine disk files are encrypted.

The PoisonX driver. The PoisonX driver used in the GodDamn incident is a malicious kernel driver carrying a valid Microsoft signature. It can terminate security processes, strip their permissions and tamper with kernel event notifications so security products stop receiving alerts; it was previously used to kill the CrowdStrike Falcon service through an undocumented IOCTL interface. The Gentlemen's operators have also built it into a defence-disabling tool handed to their affiliates.