Monster is a Delphi-written locker rented out as a service that an incident response team ran into in March 2022, with its affiliate programme advertised on the RAMP forum that June. It ships as a 32-bit Windows program whose hidden control panel lets the operator pick which files to lock, whether it deletes itself and which services and processes to stop; the operator also chooses the file extension and writes the ransom note, so no fixed suffix or note name identifies it. It checks the system locale and spares machines in twelve CIS countries, and reports each target's IP address and location through the IP Logger service. If files carry an unfamiliar suffix and a custom note, disconnect the host and keep the encrypted files and note untouched. Its developer later released an upgraded kit, Beast, which adds Linux and ESXi builds; see the Beast page.
Sources: Cyberint
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161