Beast (GIGAKICK) is a Ransomware-as-a-Service (RaaS) operation targeting globally while avoiding CIS countries.
Beast (also tracked as GIGAKICK) is a Ransomware-as-a-Service (RaaS) operation. It targets victims globally while avoiding encryption in CIS countries through geographic identification. Its key TTPs include SMB scanning, file encryption, and starting/stopping services and processes. Defenders should focus on anomalous SMB traffic, unauthorized service manipulations, and ensuring geographic blocking controls are reviewed.
Beast is a Ransomware-as-a-service (RaaS) product which provides functionality such as SMB scanning, file encryption, service and process starting and stopping, and geographic identification to avoid encryption in CIS countries.
Beast uses geographic identification to avoid encryption in CIS countries.
Its key TTPs include SMB scanning, file encryption, and starting/stopping services and processes.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.