24/7 incident response by senior DFIR experts. Get in touch now – we help you stabilise, investigate and recover.
Beast, also known as Gigakick, is a double-extortion ransomware operation targeting organisations across multiple sectors. Campaigns include data theft and destructive encryption, with stolen data published on a Tor-based leak site to increase pressure on victims.
*.onion (Tor-based data leak blog)Beast campaigns have impacted organisations in Europe, North and South America, Asia and other regions. Public victim listings span manufacturing, professional services, technology, logistics and other critical business functions.
Like many modern RaaS operations, Beast focuses on targets where operational disruption and data exposure can be leveraged to maximise pressure during negotiations.
Beast follows a double extortion model: systems are encrypted and data is exfiltrated to attacker-controlled infrastructure, then selectively leaked on a Tor site if victims do not comply.
Ransom notes typically instruct victims to contact the operators via Tor-based chat portals or other anonymised channels. Payment is demanded in cryptocurrency, with threats of full data publication or resale on underground markets.
While every incident is different, Beast intrusions commonly follow a multi-stage playbook. Understanding these phases helps prioritise actions in the first hours and days of a response.
Phase 1 – Initial access & reconnaissance
Compromise & environment mapping
Access is often obtained via exposed services, compromised accounts or vulnerable edge systems. Once inside, operators map Active Directory, file shares and backup infrastructure.
Phase 2 – Privilege escalation & data theft
Credential access & exfiltration
Stolen credentials, privilege escalation and the deployment of tools for discovery and data exfiltration (e.g. file transfer utilities or custom scripts) are common at this stage.
Phase 3 – Encryption & extortion
Ransomware deployment & leak threats
After staging, Beast binaries are pushed to critical systems and executed, often after attempts to disable security tooling and backups. Ransom notes and a link to the leak site are left behind.
Our incident response playbook for Beast and similar groups is structured around stabilisation, evidence preservation and controlled recovery.
The following example artefacts are provided for defensive purposes. Use them as input for threat hunting and detection engineering in combination with behavioural analytics.
Exact file names, hashes and ransom note wording vary between campaigns and affiliates. Use current threat-intel feeds and logs from your own environment for precise matching.
When reviewing firewall, proxy and EDR logs, correlate suspicious external connections with spikes in process creation and file access events on servers.
Beast’s tradecraft overlaps with many contemporary ransomware and eCrime groups. The following mapping is a representative example and should be adapted to your environment and telemetry.
T1078 (Valid Accounts), T1133 (External Remote Services)T1059 (Command and Scripting Interpreter)T1547 (Boot or Logon Autostart Execution)T1068 (Exploitation for Privilege Escalation)T1562 (Impair Defenses), disabling AV/EDR and backupsT1003 (OS Credential Dumping)T1087 (Account Discovery), T1018 (Remote System Discovery)T1021 (Remote Services)T1119 (Automated Collection)T1041 (Exfiltration over C2 Channel)T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery)As a specialised digital forensics and incident response team, we help organisations manage Beast and other ransomware incidents in a structured, risk-based way: