Loading malware…
Monster is a ransomware family associated with the threat actor and ransomware-as-a-service operation tracked as Hyadina. First observed in 2022, it is the earliest known member of a lineage that later rebranded as Beast and then GodDamn, with researchers identifying significant code and tradecraft continuity across the family. Early Monster samples were described as Delphi-based and focused on Windows, particularly 32-bit systems, while later descendants expanded to Linux and VMware ESXi environments.
Monster and its successors are used in enterprise-targeted intrusions that emphasize pre-encryption access expansion and defense evasion. Reported operator tradecraft includes use of remote administration software for hands-on access, credential theft with NirSoft utilities and Mimikatz, network reconnaissance, lateral movement with administrative tooling such as PsExec, and disabling security controls prior to encryption. Across the Hyadina lineage, operators have also shown a pattern of avoiding victims in Commonwealth of Independent States and former Soviet countries.
As a ransomware family, Monster is designed to encrypt victim data and present a ransom demand. Subsequent rebrands in the same lineage demonstrate continued development of tooling and operational maturity, including stronger defense evasion and broader platform support. Victim sectors linked to Hyadina activity have included healthcare, manufacturing, education, and other organizations, with a primary focus reported on targets in the United States.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GodDamn ransomware first appeared in May 2026 and analysis of the code revealed that it is the newest iteration of Beast ransomware, itself is a rebrand of Monster ransomware which was first seen in 2022.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An earlier ransomware variant associated with Hyadina before the group moved to GodDamn.
Earlier ransomware family from 2022 that the article links by lineage and code overlap to Beast and GodDamn.
An earlier ransomware form first seen in 2022 and described as the predecessor to Beast within the same family later dubbed Hyadina.
An earlier ransomware family in the same lineage that emerged in November 2022 and later rebranded to Beast.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.