Beast Ransomware Emerges as New RaaS Threat, Using ChaCha20 and Stealthy VSS Deletion

Researchers at the AhnLab Security Intelligence Center outline Beast as a rapidly expanding RaaS operation that evolved from the Monster ransomware family, emerging in February 2025 and launching a Tor-based data leak site in July. By August, the Beast group had disclosed 16 victims across the United States, Europe, Asia and Latin America, indicating a non-targeted, high-volume monetisation strategy.

The malware uses ChaCha20 as its primary encryption algorithm and decrypts its data section via a ChaCha20-based key setup, with embedded markers checked on execution. Beast spreads mainly through phishing campaigns and SMB exploitation, and it performs environment checks to exclude certain regions before encrypting, while also self-replicating and persisting under the Windows Run key.

It deletes Shadow Volume Copies using WMI COM interfaces to erase recovery points and terminates more than 80 processes and services, including major backup and database tools, to maximise encryption success. According to AhnLab, this combination of characteristics makes decryption virtually impossible unless the key management or algorithm is compromised.