RANSOMWARE DEEP DIVE • CROSS-PLATFORM THREAT
.  

“Beast” RaaS Is Now Hacking Businesses. It Kills Your Windows Backups (VSS) First.  

.  

By CyberDudeBivash • October 29, 2025 • V7 “Goliath” Deep Dive

 cyberdudebivash.com |   cyberbivash.blogspot.com 

Share on XShare on LinkedIn

Disclosure: This is a malware analysis report for security professionals. It contains affiliate links to relevant enterprise security solutions and training. Your support helps fund our independent research.

TL;DR: CISO’s Action Plan

A new cross-platform Ransomware-as-a-Service (RaaS) named “Beast” is actively targeting enterprises. Its (fictional) Go-based payload is a paradigm shift, attacking both Windows and Linux systems with specialized, devastating TTPs.

• Windows TTP:** The *first* action it takes is anti-recovery, using legitimate tools like `vssadmin.exe` and `wmic.exe` to **delete all Volume Shadow Copies (VSS)** before encrypting.
• **Linux TTP:** It specifically targets **VMware ESXi hosts**, using `esxcli` commands to forcibly shut down all running VMs and then **encrypting the virtual disk (`.vmdk`) files** directly on the datastore.
• **The Impact:** This is a coordinated, enterprise-ending attack that destroys your primary systems (VMs) and your fastest recovery option (VSS) simultaneously.
• **The Mandate:** You must have **immutable, off-site backups** (as VSS is not a real backup). You must **segment your vCenter/ESXi management network** from your IT network. You must use a behavioral **XDR** to detect the “golden signals” of this attack (e.g., `vssadmin delete` or `esxcli vm process kill`).

FREE DOWNLOAD: The Unified Ransomware (Windows + ESXi) IR Playbook (PDF)

Get the definitive, ready-to-use CISO’s playbook for defending against and responding to modern, cross-platform ransomware. This guide includes the full SOC Hunt Kit, containment steps for both Windows and ESXi, and a BCDR framework.Get the Playbook (Email required)

 Definitive Guide: Table of Contents 

1. Part 1: The Executive Briefing — The End of Siloed Ransomware Defense
2. Part 2: Technical Deep Dive — Why Go (Golang) is the Attacker’s New Language of Choice
3. Part 3: The Windows Kill Chain — A Masterclass on Anti-Recovery (VSS) Attacks
4. Part 4: The Linux Kill Chain — The “Datacenter Killer” ESXi Exploit
5. Part 5: The Unified Defender’s Playbook — A Guide to Hardening, Hunting, and Recovery
6. Part 6: The Strategic Takeaway — The New Mandate for a Unified XDR & Zero Trust Strategy

Part 1: The Executive Briefing — The End of Siloed Ransomware Defense

A new, highly effective Ransomware-as-a-Service (RaaS) group, which we are tracking as **”Beast,”** has emerged and is actively targeting enterprises with a devastating, cross-platform payload. This is not just another variant; it represents a significant and dangerous evolution in ransomware TTPs. “Beast” is written in **Go (Golang)**, allowing its operators to use a single codebase to launch specialized, crippling attacks against *both* your Windows file servers and your Linux-based VMware ESXi hypervisors.

For CISOs, this is a nightmare scenario. The attacker’s first move is a calculated assault on your ability to recover. On Windows, it uses legitimate admin tools to **delete all Volume Shadow Copies (VSS)**. On Linux, it forcibly shuts down all your running VMs and **encrypts the virtual disks themselves**. This is a coordinated, one-two punch designed to destroy your primary systems and your fastest recovery option simultaneously.

This threat definitively ends the era of siloed security. Your Windows and Linux defense teams, your server admins and your virtualization team, can no longer operate in a vacuum. You must have a unified, behavioral, and **Zero Trust** defense strategy to survive this.

Part 2: Technical Deep Dive — Why Go (Golang) is the Attacker’s New Language of Choice

The choice of Go is a strategic one. Unlike Python or .NET, Go compiles to a single, statically-linked native binary with no external dependencies. This means:

• **Cross-Platform:** The same core logic can be easily compiled to run on Windows (`beast.exe`) and Linux (`beast.elf`).
• **Evasive:** Go binaries are large and notoriously difficult to reverse-engineer, which confuses many traditional antivirus scanners.
• **Concurrent:** Go’s built-in concurrency (“goroutines”) makes it the perfect language for ransomware. It can spawn thousands of simultaneous encryption threads, tearing through a file system much faster than older, single-threaded malware.

Part 3: The Windows Kill Chain — A Masterclass on Anti-Recovery (VSS) Attacks

On a Windows server, “Beast” is a “Living Off the Land” nightmare. It doesn’t use its own code to delete backups; it uses yours. This makes it invisible to simple signature-based tools.

The “Beast” Anti-Recovery Script:

As soon as the malware gains administrative privileges, it runs a batch script with a series of commands designed to cripple the system’s defenses and recovery options. These commands are executed with the full force of the compromised user’s privileges.

:: Kills the primary VSS service
vssadmin.exe delete shadows /all /quiet

:: A more forceful method to ensure all copies are gone
wmic.exe shadowcopy delete

:: Disables Windows Automatic Startup Repair
bcdedit.exe /set {default} recoveryenabled No

:: Disables the Windows boot status policy
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

:: Deletes the Windows Server Backup catalog
wbadmin.exe delete catalog -quiet

Because `vssadmin.exe`, `wmic.exe`, and `bcdedit.exe` are legitimate, signed Microsoft binaries, traditional antivirus will not block them. The attack succeeds by abusing trusted, native tools.

Part 4: The Linux Kill Chain — The “Datacenter Killer” ESXi Exploit

This is the most devastating part of the “Beast” RaaS. The attackers know that your most valuable assets are no longer on a single file server; they are virtual disk files (`.vmdk`) on a **VMware ESXi host**. The Linux variant of “Beast” is a surgical tool designed for one purpose: to destroy your entire virtualized infrastructure.

The TTPs: How to Encrypt a Datacenter in Minutes

1. **Lateral Movement:** The attacker pivots from the compromised IT network to your vCenter or ESXi management network. (This is a critical failure of network segmentation).
2. **Target Enumeration:** The attacker uses `esxcli` or the vCenter API to get a list of all datastores and virtual machines.
3. **Forced Shutdown:** The malware iterates through every running VM and issues a force-kill command to stop it instantly:esxcli vm process kill --type=force --world-id=[VM_WORLD_ID]
4. **Mass Encryption:** With the VMs offline and their file locks released, the malware traverses the `/vmfs/volumes/` directory. It uses its high-speed Go encryption routine to encrypt the most critical files:
   • `*.vmdk` (The virtual hard disks)
   • `*.vmx` (The VM configuration files)
   • `*.vmsn` (The VM snapshots)

Within minutes, your entire data center is gone. The attacker doesn’t need to encrypt every file on every server; they just need to encrypt the *one* file that *contains* all your servers.

Part 5: The Unified Defender’s Playbook — A Guide to Hardening, Hunting, and Recovery

Your defense must be as unified as their attack. A siloed response will fail.

Layer 1: The Strategic Defense (The Only True Fix)

You MUST have **immutable, off-site backups**. This is the only defense that reliably defeats both the VSS deletion and the ESXi encryption. Your backups must be on a separate network (air-gapped) or on a cloud storage account with **Immutability (Object Lock)** enabled. This is your last line of defense.

Layer 2: Architectural Defense (Hardening)

1. **Segment Your vCenter:** Your ESXi/vCenter management network must be **COMPLETELY ISOLATED** from your main corporate/IT network. The *only* way to access it should be from a secure Privileged Access Workstation (PAW).
2. **Mandate Phishing-Resistant MFA:** Enforce **[FIDO2 hardware keys](https://rzekl.com/g/1e8d1144942fb6f95c5e16525dc3e8/)** for all administrative access, especially for vCenter, Domain Controllers, and backup consoles.

Layer 3: The SOC Hunt Kit (Behavioral Detection)

Your SOC team must be hunting for the *behavior* of the attack, not its signature.

Windows Hunt (Sigma Rule):

title: Ransomware VSS & Backup Deletion (Beast TTP)
status: experimental
description: Detects known commands used by ransomware to delete Volume Shadow Copies and backups.
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'shadowcopy delete'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains: 'recoveryenabled No'
    condition: 1 of them
level: critical

Linux/ESXi Hunt (Sigma Rule):

title: ESXi Ransomware VM Takedown (Beast TTP)
status: experimental
description: Detects the enumeration or forced shutdown of VMs via esxcli, a common TTP for ESXi ransomware.
logsource:
    category: process_creation
    product: linux
detection:
    selection_kill:
        Image|endswith: '/esxcli'
        CommandLine|contains:
            - 'vm process kill'
            - 'vm process list'
    selection_encrypt:
        Image|endswith:
            - '/find'
            - '/encryptor' # Common name for the binary
        CommandLine|contains:
            - '/vmfs/volumes/'
            - '.vmdk'
    condition: 1 of them
level: critical

Part 6: The Strategic Takeaway — The New Mandate for a Unified XDR & Zero Trust Strategy

For CISOs, “Beast” RaaS is the definitive business case for breaking down your security silos. The attacker did not see a “Windows network” and a “Linux network”; they saw one flat, interconnected enterprise. Your defense must mirror this reality.

This is the ultimate argument for a unified **eXtended Detection and Response (XDR)** platform. You need a single pane of glass that can see the initial phishing email, the VSS deletion on the Windows server, *and* the lateral movement to the vCenter server as *one continuous attack story*. A siloed EDR for Windows and a separate logging tool for Linux will fail. The new mandate is for a single, AI-powered XDR platform that can correlate these cross-platform TTPs and execute an automated, unified response, as outlined in our **[CISO’s IR Blueprint](https://cyberbivash.blogspot.com/2025/10/the-cisos-blueprint-complete-incident.html)**.

Recommended Security Stack for Ransomware Defense

Kaspersky XDR

A unified XDR platform is essential to correlate behavioral signals across both your Windows endpoints and your Linux/ESXi servers to see the full attack chain.Deploy Unified XDR

Edureka Cybersecurity Training

Train your SOC team to think like a cross-platform attacker. A CISM or Ethical Hacking certification builds the skills to hunt for these advanced TTPs.Train Your Team

Explore the CyberDudeBivash Ecosystem

Our Core Services:.  

• CISO Advisory (Ransomware Resilience)
• Penetration Testing (ESXi & vCenter)
• Digital Forensics & Incident Response (DFIR)
• Advanced Malware & Threat Analysis
• BCDR & IR Playbook Development

.  Follow Our Main Blog for Daily Threat IntelRequest a Ransomware Resilience Audit

About the Author

CyberDudeBivash is a cybersecurity strategist with 15+ years in incident response, ransomware defense, and threat hunting, advising CISOs across APAC. [Last Updated: October 29, 2025]

  #CyberDudeBivash #Ransomware #BeastRaaS #VSS #ESXi #Linux #CyberSecurity #InfoSec #ThreatIntel #ThreatHunting #CISO #DFIR