Beast Ransomware Targets Active SMB Connections to Infect Entire Networks

Beast Ransomware has emerged as a sophisticated operation that targets active SMB connections to propagate across enterprise networks and encrypt files. The malware uses aggressive SMB port scanning to identify shared folders and resources for lateral movement, enabling rapid spread after initial access.

It operates as a Ransomware-as-a-Service (RaaS) platform, with multiple threat actor partners conducting campaigns under the same infrastructure, and began its activity publicly in July 2025 with 16 publicly disclosed victims across the United States, Europe, Asia, and Latin America, according to aseс.ahnlab[.]com.

Initial access is typically gained via phishing campaigns that deliver Vidar Infostealer as a secondary payload to harvest credentials before deployment, and the group employs geofencing to exclude CIS regions from targets. Beast encrypts files using ChaCha20, appends a unique 18-byte identifier, and inserts 0xA0 bytes of metadata containing encryption parameters, while also deleting Windows Shadow Copy volumes to hinder recovery.