THREAT ACTOR
BEAST_
ActiveBEAST is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BEAST, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 27
- 2025 46
Leak site mirrors
10 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd.onionBEAST LEAKS | Index snapshot · 2026-09-23 05:30 -
ooie6tet7ggcmlgvtmyvok4s6vha6ecwczssbchbyxrg2r6v2m6zkkad.onionIndex of / snapshot · 2025-08-15 02:04 -
xzxvf4x2hxivr3q2ffzultcqiun5flwfp6fyoqtvbx3p4an4smefmjqd.onionsnapshot · 2025-09-13 00:42 -
inqqzxkjfronl3fb5uazmveq4txxatykoadg4gtga3euzi2ffobsyxqd.onionsnapshot · 2026-04-08 23:40 -
mq2yz7rgz6twml5tcmno23rlgp5v6gzqlxucalkgu2ssghsswz75xkyd.onionsnapshot · 2026-04-08 23:41 -
isnunjmt7nvxwe2q2xvynntrqfjga7qpywiwtol4rmyoycwrccjezcad.onionsnapshot · 2026-04-08 23:48 -
sxsjteplangjoknelabsjdw6lqdq2g7ak5fkmlbhmj7sztrk2ono24yd.onionSt Andrew's CE High School snapshot · 2026-07-24 22:19 -
gutatzqnumcmlfhq3txzz47gkhf7opozw2potunt2d7d2vne3apfuqqd.onionrichardalibon.co.uk snapshot · 2026-07-23 16:07 -
iipl7n3txrysjnclu24deu2pbrkse5y5oiwqyvs6mjdxlisilqpssiad.onionruskin.ac.uk snapshot · 2026-07-24 03:27 -
brt2oxyj3pj5lwdyztcnhjuv3ufqisaw4osup4zzzfmvchxm4vya56id.onionidealforwarding.co.uk snapshot · 2026-07-25 09:10
Recent victims
The 50 most recent victims claimed by BEAST. Total in the index: 73.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-10 | M800 and CINNOX | M800 helps businesses connect globally with virtual numbers, SMS, voic… |
| 2026-08-25 | Cosmon | Cosmon develops agentic artificial intelligence software for mechanica… |
| 2026-08-24 | Meridian Forest Services | Meridian Forest Services Limited is a progressive natural resource con… |
| 2026-05-17 | Trivantage | Trivantage is a wholesale supplier specializing in awning, marine, and… |
| 2026-04-24 | Lessard Dental | Lessard Dental is a family dental practice located in West Edmonton, o… |
| 2026-04-08 | irmler.org | irmler.rechtsanwalte specializes exclusively in architectural law, pub… |
| 2026-04-02 | project1631.com | project1631.com |
| 2026-04-01 | Xiamen Tungsten Co. (XTC) | Xiamen Tungsten Co. (XTC) - Full Infrastructure Dump 2026 |
| 2026-03-14 | Trinity Catholic High School | Trinity Catholic High School offers a full array of co-curricular acti… |
| 2026-03-14 | Communicate UK | Communicate UK is a customer-focused security company based in the sou… |
| 2026-03-03 | Camelot Electronics Technology Co., Ltd. | Camelot Hubei Technology Limited Company (also known as Hubei Camelot … |
| 2026-02-24 | Sungwoo Co., Ltd | Overview: Sungwoo Co., Ltd. is a South Korean manufacturer primarily e… |
| 2026-02-24 | SAIC Motor Corporation | SAIC Motor Corporation Limited is the largest state-owned automobile m… |
| 2026-02-24 | AJU Pharm Co., Ltd | AJU Pharm Co., Ltd. is a prominent South Korean total healthcare compa… |
| 2026-02-18 | First 4 Recruitment | First 4 Recruitment is a prominent recruitment agency based in the Nor… |
| 2026-02-18 | Daniel L Kaler, DDS, PC | Daniel L. Kaler, DDS, PC offers unparalleled orthodontic services to c… |
| 2026-02-11 | Law Office of COX & SANCHEZ | The Law Firm of Cox & Sanchez has been committed to serving the reside… |
| 2026-02-11 | Andringa Law | Bob Andringa has been involved in commercial and real estate litigatio… |
| 2026-02-09 | Hospital Sao Jose do Avai (HSJA) | JPS Consulting Engineers is a group of dynamic site, civil and structu… |
| 2026-02-05 | Yulkok Ltd | Yulkok Ltd. (South Korea) |
| 2026-01-29 | Ruskin College | Ruskin College Oxford provides accessible adult learning opportunities… |
| 2026-01-23 | St Andrew's CE High School | St Andrew's School Worthing is a co-educational secondary school dedic… |
| 2026-01-21 | Orthopaedic Specialists of Massachusetts | Orthopaedic Specialists of Massachusetts provides superior orthopaedic… |
| 2026-01-13 | Richard Alibon Primary School | Richard Alibon Primary is a school where all individuals are valued an… |
| 2026-01-13 | Ideal International | Ideal International specializes in international freight forwarding, w… |
| 2026-01-13 | Collett Hulance | Collett Hulance is a Chartered Certified Accountants firm based in Bed… |
| 2026-01-13 | Commercial Paving Ltd. | Commercial Paving Ltd. is a Calgary-based company with over 40 years o… |
| 2025-11-23 | Outback Pharmacies | Outback Pharmacies operates five locations in Broken Hill, providing a… |
| 2025-11-13 | Goldhorse Capital Management | The company's customers' personal data, databases, and source code hav… |
| 2025-11-09 | Ringmor | CallMor offers virtual phone system services aimed at businesses looki… |
| 2025-11-09 | Punjab Forensic Science Agency | The Punjab Forensic Science Agency (PFSA) provides a range of forensic… |
| 2025-11-09 | Noroaco | Noroaco - Ferro e Aco specializes in a diverse range of high-quality s… |
| 2025-10-27 | GeBePro | The company's activities include the operational management of technic… |
| 2025-10-27 | Bolt Electricity, Oil & Gas | Bolt Energy specializes in providing energy solutions aimed at reducin… |
| 2025-10-24 | Danthi Comunicacao Integrada | With a senior team and over 130 clients, Danthi Comunicacao Integrada … |
| 2025-10-21 | Microdevice | Microdevice specializes in building automation systems, offering super… |
| 2025-10-06 | Perennial | Perennial Cable is a global supplier specializing in custom cable asse… |
| 2025-10-06 | The Methodist Church of Southern Africa | The Methodist Church of Southern Africa is dedicated to proclaiming th… |
| 2025-10-04 | Garro Fabril | Garro Fabril SA is a company that operates in the Manufacturing indust… |
| 2025-09-24 | Valufinder Group | Valufinder Group, Inc. is a boutique investment banking firm, recogniz… |
| 2025-09-16 | Medpeds | MedPeds Associates, located in Sarasota, Florida, specializes in Inter… |
| 2025-09-12 | Meskan Foundry | Meskan Foundry is a 5th generation, family owned, non-ferrous casting … |
| 2025-09-06 | BinBaires | BinBaires is a company that operates a network of casinos and bingo ha… |
| 2025-08-25 | Van Hook Dental Studio | Van Hook Dental Studio is a privately-owned dental laboratory that ser… |
| 2025-08-22 | Mobal Trucking | CONTACT INFORMATION |
| 2025-08-22 | Jack's Lawn Service, Inc. | Jack's Lawn Service, Inc., located in Monroe, Michigan, offers a compr… |
| 2025-08-21 | Colmar Industrial Supplies | Colmar Industrial Supplies Inc. is a leading distributor of cutting to… |
| 2025-08-21 | Huron Regional Medical Center | HRMC is a private, not-for-profit organization. When the ownership of … |
| 2025-08-20 | Din Bolig | Din Bolig is a company that operates in the Real Estate industry. It e… |
| 2025-08-19 | Cain Electric | At Cain Electric, we provide a full array of different services for ou… |
CONFIRMED ATTACKS
Beast confirmed attacks: 9 verified incidents
Ransomnews has verified 9 Beast incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from February 2025 to April 2026. United States accounts for 5 of them (56%), with victims recorded in 5 countries in total. The most affected sector is healthcare, at 5 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 8. Where a figure was disclosed (4 cases), these incidents account for 65,661 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Beast incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| April 2026 | irmler. rechtsanwälte | Legal | Schwerin, Germany | — | Unknown | Source |
| November 2025 | Outback Pharmacies | Healthcare | Broken Hill, Australia | — | Unknown | Source |
| November 2025 | Punjab Forensic Science Agency | Government | Lahore, Pakistan | — | Unknown | Source |
| September 2025 | MedPeds Associates of Sarasota | Healthcare | Florida, United States | 21,430 | Unknown | Source |
| July 2025 | Meadowlark Hills (Manhattan Retirement Foundation) | Healthcare | Kansas, United States | 14,442 | Unknown | Source |
| June 2025 | PROVAIL | Healthcare | Washington, United States | 4,391 | Unknown | Source |
| May 2025 | Huron Regional Medical Center, Inc. | Healthcare | South Dakota, United States | 25,398 | Unknown | Source |
| May 2025 | Washington Court House | Government | Ohio, United States | — | No | Source |
| February 2025 | Hafnia Law Firm | Legal | Copenhagen, Denmark | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Beast's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.