beast

Beast is a ransomware-as-a-service group active since June 2024 and believed to be a successor to the Monster ransomware gang, operating under an extortion model with an extensive toolkit for reconnaissance and credential theft exposed in an open directory. ThreatCluster records 67 victims claimed, with Healthcare, Manufacturing, Business Services, Education, and Construction as the sectors hit most often, and the US, KR, BR, CN, and DE as the countries most affected. The pattern across the recent reporting shows a focus on publicly exposing attack tooling, as illustrated by the 2026-03-20 open directory incident that disclosed their reconnaissance and credential-theft tools.

Sectors: Healthcare, Manufacturing, Education · Countries: US, KR, BR