Skip to main content
Darkfield

Operator dossier

beast is a ransomware operator currently active on public leak sites. Darkfield has indexed 104 public victims claimed by this operator between July 29, 2025 and June 11, 2026. The Beast ransomware group is a relatively new threat actor that emerged in July 2025, operating with apparent financial motivations through their ransomware campaigns. With limited public documentation available from major security agencies, the group has demonstrated activity primarily targeting victims across the United States, United Kingdom, Brazil, South Korea, and Argentina, accumulating approximately 65 known victims since their emergence. Their targeting pattern shows a focus on healthcare organizations, manufacturing companies, educational institutions, and construction firms, suggesting an opportunistic approach rather than highly specialized sector expertise. The group's recent emergence means there is insufficient public intelligence from CISA, FBI, Mandiant, or other established security researchers regarding their specific attack methodologies, initial access vectors, or technical capabilities. Given the timeline of their first observation in mid-2025, Beast represents an active and emerging threat with their current operational status remaining unclear due to limited threat intelligence reporting from authoritative sources.

Most-targeted sectors

Most-affected countries

Recent disclosures by beast

All 104 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for beast →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

beast

104 victims indexed · first seen 1 year ago · last activity 1 month ago

104
Victims indexed
#74 of 364 tracked operators
11m
Active period
Jul 2025 → Jun 2026
10
Countries hit
top US · 20

At a glance

Status
active
First seen
1 year ago
Last activity
1 month ago
Onion sites
1 known endpoint
Primary sector
Not Found · 21 hits

About

The Beast ransomware group is a relatively new threat actor that emerged in July 2025, operating with apparent financial motivations through their ransomware campaigns. With limited public documentation available from major security agencies, the group has demonstrated activity primarily targeting victims across the United States, United Kingdom, Brazil, South Korea, and Argentina, accumulating approximately 65 known victims since their emergence. Their targeting pattern shows a focus on healthcare organizations, manufacturing companies, educational institutions, and construction firms, suggesting an opportunistic approach rather than highly specialized sector expertise. The group's recent emergence means there is insufficient public intelligence from CISA, FBI, Mandiant, or other established security researchers regarding their specific attack methodologies, initial access vectors, or technical capabilities. Given the timeline of their first observation in mid-2025, Beast represents an active and emerging threat with their current operational status remaining unclear due to limited threat intelligence reporting from authoritative sources.

References

3 links

External sources curated by the MISP threat-intel community.

Timeline

8 months
2025-07-01T00:00:00+00:00 · 162025-08-01T00:00:00+00:00 · 142025-09-01T00:00:00+00:00 · 42025-10-01T00:00:00+00:00 · 72025-11-01T00:00:00+00:00 · 52026-01-01T00:00:00+00:00 · 72026-02-01T00:00:00+00:00 · 92026-03-01T00:00:00+00:00 · 3
2025-07-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
20
🇬🇧 United Kingdom
4
🇧🇷 Brazil
3
🇰🇷 South Korea
3
🇦🇷 Argentina
2
🇬🇧 United Kingdom
2
🇨🇳 China
2
🇿🇦 South Africa
1
United States dossier →United Kingdom dossier →Brazil dossier →South Korea dossier →

Top sectors

Healthcare
11
Manufacturing
8
Education
6
Construction
5
Business Services
4
Technology
3
Financial Services
2
Consumer Services
1
Healthcare dossier →Manufacturing dossier →Education dossier →Construction dossier →

MITRE ATT&CK

4 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd.onion

Source

Updated 1 month ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time beast posts a victim.

Add beast to your watchlist — Pro pings you within 5 minutes of any new beast leak-site post, Telegram callout, or affiliate-rebrand inference.