JEDI-SEC | Security Research & Digital Defense

Beelzebub Ransomware Announces Major Rewrite and Recruitment Push for New Operators

Written by

jedisec_u136k7

in

Ransomware Recruitment Report
Defense Evasion
Affiliate Recruitment
Targeting Expansion
Observed

Beelzebub Ransomware Announces Major Rewrite and Recruitment Push for New Operators

Update typeFull rewrite
Recruitment roles3
Primary focusDefense evasion
StatusRecruiting

Overview

Beelzebub Ransomware Announces Major Rewrite and Recruitment Push for New Operators

An actor using the handle “WolfBlxck” posted an updated recruitment announcement for Beelzebub ransomware, claiming the malware has been rewritten from scratch with a stronger emphasis on disabling endpoint defenses, suppressing telemetry and making incident response more difficult.

The post also expands the recruitment pitch, stating that the operator is looking for three additional people: a developer, a penetration tester and a negotiator. The actor lists hospitals, schools and universities, small and medium-sized businesses, and local cloud providers as proposed target categories. The recruitment post is directly visible in the supplied screenshots, but the malware capabilities and operational claims have not been independently validated.

Post details

ProgramBeelzebub Ransomware
ActivityMalware update and recruitment
Actor“WolfBlxck”
Update typeComplete rewrite
Primary focusDefense evasion and disruption of security tooling
Recruitment rolesDeveloper, penetration tester, negotiator
Target categories namedHealthcare, education, SMBs, local cloud providers
Observed date

What the post claims

  • Complete rewrite of the ransomware codebase
  • Focus on bypassing antivirus and EDR products
  • Claims to interfere with endpoint-security products
  • Claims to terminate monitoring and analysis utilities
  • Claims to suppress AMSI and ETW visibility
  • Claims to disable PowerShell logging
  • Claims to disable Windows security controls
  • Claims to remove recovery components
  • Claims to wipe Windows event logs and other forensic artifacts
  • Claims to disable remote-management and network services
  • Claims to restrict common administrative tools
  • Claims multiple persistence mechanisms
  • Claims propagation through removable media and network shares
  • Recruiting one developer
  • Recruiting one penetration tester
  • Recruiting one negotiator
  • Hospitals named as proposed targets
  • Schools and universities named as proposed targets
  • SMBs and local cloud providers named as proposed targets

The actor also outlines internal operational rules covering secrecy, role separation and profit-sharing. Those details are summarized at a high level here rather than reproduced as procedural instructions.

Screenshots


Screenshot 1Source screenshot

Beelzebub Ransomware Announces Major Rewrite and Recruitment Push for New Operators



Screenshot 2Source screenshot

Beelzebub Ransomware Announces Major Rewrite and Recruitment Push for New Operators

The supplied captures show the Beelzebub update announcement, claimed defense-evasion capabilities, persistence and propagation claims, recruitment roles, proposed target categories, operational rules and contact identifiers.

IOCs & identifiers

Identifiers directly visible in the supplied material. These support correlation and do not independently verify the malware’s capabilities.

Type Identifier Source
Actor handle WolfBlxck Screenshots 1–2
Ransomware name Beelzebub Screenshots 1–2
Tox ID 6D29A6A0E0BA4FAB31FA4541F89B800459CBB14736B17557B9DC79019F7B460A450E646FFB1B Screenshot 2
Session ID 051b3888c0b3e561b598579627840af056f2b9cd3600f9ef07157d290551b35442 Screenshot 2

No malware hash, Telegram handle, attacker-controlled domain or attacker-controlled IP address is visible in the supplied screenshots.

Mapped techniques

Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the capability has been independently validated.

Potential impact

If the advertised capabilities are genuine, the rewritten malware could increase operational difficulty for defenders by combining security-tool disruption, telemetry suppression, forensic artifact removal, recovery interference, persistence and network propagation before encryption. The recruitment push could also expand the operation’s technical and negotiation capacity.

Status Observed

The supplied screenshots directly document the Beelzebub update and recruitment post. Dark Web Informer has not independently verified that the malware can perform every claimed action, that the listed security products are successfully bypassed, or that the operation has recruited the roles described.

Dark Web Informer

Source: Dark Web Informer · 2026-10-16

More posts