Team Cymru Maps Beast Ransomware Toolkit from Exposed Server
Summary
Team Cymru analyzed files from an exposed Beast ransomware server, mapping tools across the intrusion lifecycle. Artifacts included credential-theft utilities, exfiltration tools, backup-disabling scripts, and Windows and Linux ransomware binaries.
Key points
- In March 2026, Team Cymru detected an open directory at 5.78.84[.]144 using its NetFlow-augmented open-port collection and analyzed files from the server.
- Network scanners, Everything.exe, and FolderSize were among the files; Team Cymru says these could help map networks, locate sensitive files, and prioritize data-rich systems.
- The server held Mimikatz, LaZagne, Automim, a WDigest registry modification, and a Kerberos script that the researchers say was likely used for Kerberoasting.
- AnyDesk, PsExec, and OpenSSH for Windows were present as tools that could support persistence and remote access or lateral movement.
- MEGAsync, WinSCP, and Klink were identified as tools usable for data exfiltration.
- A batch file was designed to delete Volume Shadow Copies and disable backups; CleanExit.exe was considered likely to wipe logs and tools.
- Windows and Linux Beast ransomware binaries were found, suggesting the operators could target workstations and Linux servers on VMware ESXi.
Article Details
- Attack Vectors
- The Beast operator toolkit included network-scanning tools to map internal networks and identify open RDP or SMB ports.
- Mimikatz, LaZagne, and Automim were found on the server for credential theft; a registry file was intended to enable cleartext password storage in memory, and a PowerShell script was likely used for Kerberoasting.
- AnyDesk was stored on the server for remote access and potential persistence; PsExec and OpenSSH for Windows were available for remote execution and access across the network.
- MEGASync, WinSCP, and Klink were identified as tools the operator used or could use to exfiltrate stolen data.
- A batch script was designed to delete Volume Shadow Copies and disable Windows backups; a separate executable was likely intended to wipe logs and tools.
- Windows and Linux Beast ransomware binaries were found, consistent with targeting workstations and Linux servers on VMware ESXi.
- Defensive Notes
- The article recommends using knowledge of the identified toolkit to focus defensive blocking, detection, and threat hunting.
- Team Cymru describes proactive telemetry collection as a way to identify ransomware operators' infrastructure and toolkit before use against targets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 5[.]78[.]84[.]144 | Beast operator open directory detected by Team Cymru in March 2026. |
| SHA256 | 2ce62601491549ab91c9517e0accf3286ed29976f6ec359d31ddc060a8d99eb3 | Listed as a Beast ransomware SHA256 file hash gathered from an open-source malware sandbox submission. |
| SHA256 | 479d0947816467d562bf6d24b295bf50512176a2d3d955b8f4d932aea2378227 | Listed as a Beast ransomware SHA256 file hash gathered from an open-source malware sandbox submission. |
| SHA256 | 5bd8f9cbd108abc53fb1c44b8d10239a2a0a9dd20c698fd2fb5dc1938ae7ba96 | Listed as a Beast ransomware SHA256 file hash gathered from an open-source malware sandbox submission. |
| SHA256 | 6718cb66521a678274e5672285bf208eac375827d622edcf1fe7eba7e7aa65e0 | Listed as a Beast ransomware SHA256 file hash gathered from an open-source malware sandbox submission. |
| SHA256 | 812df0efea089b956d08352ff0a7e8789d43862dc3764f4441d4e1c1d1fb7957 | Listed as a Beast ransomware SHA256 file hash gathered from an open-source malware sandbox submission. |
| SHA256 | cc0680de960f3e1b727b61a42e59f9c282bd8e41fe20146ed191c7f4bf9283a7 | Listed as a Beast ransomware SHA256 file hash gathered from an open-source malware sandbox submission. |
| SHA256 | cf5c45be416d1b18dd67ffa95c6434691f1f9ba9c30754fa6fc9978c1f975750 | Listed as a Beast ransomware SHA256 file hash gathered from an open-source malware sandbox submission. |
MITRE ATT&CK
T1003 · OS Credential DumpingMimikatz was present for dumping passwords from memory.T1021.004 · SSHOpenSSH for Windows was found on the server and could be used to create tunnels for remote access across systems.T1046 · Network Service DiscoveryThe operator toolkit included Advanced IP Scanner and Advanced Port Scanner to map internal networks and locate open RDP or SMB ports.T1070 · Indicator RemovalCleanExit.exe was likely used by the Beast operator to wipe logs and tools after encryption.T1083 · File and Directory DiscoveryEverything.exe and FolderSize-x64 were identified as tools for locating sensitive files and prioritizing data-rich servers.T1110.002 · Password CrackingThe article says Kerberos service-account tickets extracted through Kerberoasting could be cracked offline.T1112 · Modify RegistryThe enable_dump_pass.reg file was a registry modification intended to make Windows store passwords in cleartext in memory.T1219 · Remote Access ToolsA copy of AnyDesk was stored on the server; the article describes its use by the Beast operator for remote access and potential persistence.T1486 · Data Encrypted for ImpactWindows and Linux Beast ransomware binaries were found in the operator toolkit for encrypting victim systems.T1490 · Inhibit System Recoverydisable_backup.bat was designed to delete Volume Shadow Copies and disable Windows backups.T1555.003 · Credentials from Web BrowsersThe article says LaZagne and related credential-recovery tools can recover stored passwords from browsers.T1558.003 · KerberoastingKerberos.ps1 was likely used to extract service-account tickets for offline cracking through Kerberoasting.T1567.002 · Exfiltration to Cloud StorageThe operator used MEGASync to upload stolen data to Mega.
Threat Actors
Malware
Products
Microsoft Windows2024, an offline builder for Beast ransomware was promoted with the option to configure builds for Windows systems, network attached storage (NAS) devices, and VMware ESXi hypervisors. Beast also specificallyVMware ESXiwith the option to configure builds for Windows systems, network attached storage (NAS) devices, and VMware ESXi hypervisors. Beast also specifically avoids encrypting data on devices located in Commonwealth of
Tools
Advanced IP Scannerdata lives before they encrypt it and hold it for ransom. In the Open Directory were copies of Advanced IP Scanner and Advanced Port Scanner. These are legitimate tools often deployed by ransomware groups to mapAnyDeskOnce they have credentials, they need to move laterally. A copy of AnyDesk was stored on the server, a well known remote monitoring and management (RMM) tool used by a plethora of ransomware groups, including the mostAutomimrights over the target network, they need passwords and credentials. Copies of Mimikatz, LaZagne, and Automim were identified on the server, the gold standard for dumping passwords from memory and recovering storedKlinkdata due to it being able to handle large volumes of data. The Beast operator was also using WinSCP and Klink too, which can be used to exfiltrate data via secure file transfer protocol (SFTP) and other protocols.LaZagneof Domain Admin rights over the target network, they need passwords and credentials. Copies of Mimikatz, LaZagne, and Automim were identified on the server, the gold standard for dumping passwords from memory andMEGAsyncvia its Tor data leak site called BEAST LEAKS. To be able to steal the data, the Beast operator used MEGASync, another well-known tool used by many ransomware gangs. MEGASync works with Mega[.]nz and can be used toMimikatzgoal of Domain Admin rights over the target network, they need passwords and credentials. Copies of Mimikatz, LaZagne, and Automim were identified on the server, the gold standard for dumping passwords from memoryOpenSSHSysInternals tool, also used by many ransomware groups to spread inside a target environment. A copy of OpenSSH for Windows was also found on the server, which can be used by the attackers to create secure tunnels forPsExecTo execute commands remotely and access systems across the network, the server had a copy of PsExec, a well-known Windows SysInternals tool, also used by many ransomware groups to spread inside a target environment. AWinSCPof stolen data due to it being able to handle large volumes of data. The Beast operator was also using WinSCP and Klink too, which can be used to exfiltrate data via secure file transfer protocol (SFTP) and other
Countries
Belarusdata on devices located in Commonwealth of Independent States (CIS) countries, such as Russia, Belarus, and Moldova. Moldovaon devices located in Commonwealth of Independent States (CIS) countries, such as Russia, Belarus, and Moldova. Russiaavoids encrypting data on devices located in Commonwealth of Independent States (CIS) countries, such as Russia, Belarus, and Moldova.