MalwareUsed by 2 actorsExploits 1 CVE

PoisonX

PoisonX is a malicious Windows kernel driver used to disable or weaken endpoint security controls from kernel mode. It is notable for carrying a valid Microsoft Hardware Compatibility signature in observed campaigns, allowing it to load on Windows systems without the friction normally associated with unsigned drivers. Its documented behavior includes terminating security-related processes, stripping user-mode API hooks relied on by endpoint protection products, and in some reporting exposing kernel functionality that can be abused to kill protected security processes. PoisonX has also been described in some campaigns as part of a bring-your-own-vulnerable-driver-style defense-evasion chain, although multiple reports characterize it instead as a purpose-built malicious signed driver rather than a merely vulnerable third-party driver.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-0828Safetica ProcessMonitorDriver.sys IOCTL Privilege Bypass for Protected Process Termination

PoisonX is a signed Windows kernel driver observed in an April 2026 spear-phishing campaign against organizations in Japan and China.

via alpha cyber blogalpha-cyber.com

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Hyadina

It dropped a signed kernel driver called PoisonX. PoisonX carries a Microsoft signature, so Windows loads it without complaint. Once active, it kills security processes and strips user-mode API hooks.

via security online infosecurityonline.info

Silver Fox

この攻撃では、「PoisonX」と呼ばれるカーネルドライバと遠隔操作機能を持つ「10FXRAT(別名:PoisonX RAT)」が悪用されていることを確認しています。

via lac watchlac.co.jp

MITRE ATT&CK

Techniques & procedures

25 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566.001Spearphishing AttachmentEvidence1

LAC WATCH report published 2026-06-04 describing a spearphishing campaign against organizations in Japan and China that chains a malicious LNK downloader into the PoisonX BYOVD driver, a PXDropper component, and the 10FXRAT remote-access trojan.

T1566.002Spearphishing LinkEvidence1

攻撃はスピアフィッシングメールを起点としており、メール本文に記載されたGoogle Cloud Storageのリンクから、不正なファイルをダウンロードさせる手口が用いられていました。

Execution

2 techniques

T1106Native APIEvidence1

このデバイスインタフェースを利用する主な目的は、セキュリティ製品の無効化(0x22E010 IOCTL)と、自分自身のプロセスおよびネットワーク通信の隠蔽(0x22E008 IOCTL)です。

T1129Shared ModulesEvidence1

The malicious VERSION.dll decodes its own embedded strings with XOR 0x7a, then reads scheduler.cache, rolling-XOR-decodes it, manual-maps it into memory, and calls its entrypoint.

Persistence

2 techniques

T1543.003Windows ServiceEvidence1

その後、ファイル名と同じ名称でWindowsサービスとして登録し、このサービスを起動します。... 「DevCfgCC.sys」というファイル名で永続化ディレクトリへ書き出し、OSの起動時に自動的に読み込まれるよう、システムにサービスとして登録します。

T1547.006Kernel Modules and ExtensionsEvidence1

The validly Microsoft-signed PoisonX driver is loaded into the Windows kernel.

Privilege Escalation

4 techniques

T1068Exploitation for Privilege EscalationEvidence5

...the Microsoft-signed PoisonX kernel driver to disable endpoint security through a BYOVD-style defense evasion technique before deploying the ransomware.

T1543.003Windows ServiceEvidence1

T1547.006Kernel Modules and ExtensionsEvidence1

The validly Microsoft-signed PoisonX driver is loaded into the Windows kernel.

T1548Abuse Elevation Control MechanismEvidence1

MITRE ATT&CK Perspective The observed behavior aligns with several MITRE ATT&CK techniques, including: ... Privilege Escalation

Stealth

8 techniques

T1014RootkitEvidence2

The most notable addition in this GodDamn attack was the PoisonX kernel driver... letting it terminate security processes and strip protective hooks at the kernel level.

T1027Obfuscated Files or InformationEvidence1

マルウェア内部にハードコードされている暗号化された10FXRAT関連ファイル...を、Incremental XORを用いて復号します。

T1027.007Dynamic API ResolutionEvidence1

StartPayload resolves APIs dynamically, initializes direct syscall helpers, binds Winsock, and loads any cached plugins from disk.

T1036MasqueradingEvidence6

First, the operators staged a defense-evasion tool disguised as a Symantec product.

T1070Indicator RemovalEvidence1

これを受け取ったドライバは、WindowsのカーネルAPIや、正規のネットワーク監視ドライバ(¥Driver¥nsiproxy、¥Device¥Tcpなど)をフックし、指定されたPIDのプロセス情報と通信記録をシステムから除外します。これにより、OSのプロセス一覧から自身の存在を消し去り、タスクマネージャーやEDR等の各種システム監視ツールから、プロセスおよびC2サーバとの不正な通信活動を隠蔽することが可能となります。

T1140Deobfuscate/Decode Files or InformationEvidence2

the signed host side-loads the attacker DLL, which decrypts the bundled cache to stage the driver and RAT.

T1218System Binary Proxy ExecutionEvidence1

Researchers observed the ransomware deploying a Microsoft-signed PoisonX driver before launching encryption.

T1620Reflective Code LoadingEvidence1

After decryption the plugin is loaded from memory as a reflective DLL and the decrypted copy is zeroed before freeing.

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

MITRE ATT&CK Perspective The observed behavior aligns with several MITRE ATT&CK techniques, including: OS Credential Dumping

Discovery

3 techniques

T1033System Owner/User DiscoveryEvidence1

GET_STARTUP_ITEMS Startup enumeration none

T1057Process DiscoveryEvidence3

Defense Evasion GodDamn employs multiple techniques to avoid detection. These include: Kernel driver abuse Security process termination

T1082System Information DiscoveryEvidence1

GET_SYS_SUMMARY Host fingerprint none

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

They installed AnyDesk for remote control and dropped it in a user’s Music folder.

T1570Lateral Tool TransferEvidence1

A reusable installer script pushed the setup to at least 10 hosts.

Collection

1 technique

T1113Screen CaptureEvidence1

Screen capture is built into core, not plugin-dependent. It uses GDI/GDI+ to capture the selected display as JPEG.

Other

2 techniques

T1562Impair DefensesEvidence11

Once active, it kills security processes and strips user-mode API hooks. That blinds the endpoint.

T1562.001Disable or Modify ToolsEvidence3

PoisonX (g11.sys) and a fake-Symantec user-mode tool (symantec.exe) kill, strip or blind AV/EDR (BYOVD).

INDICATORS OF COMPROMISE

IOCs tracked for this family

58 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

13 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

42 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 days ago

domain●●●●●●●●●●●●View more in app1 month ago

uri●●●●●●●●●●●●View more in app1 month ago

hash.sha256●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

16 SOURCESView more in app

alpha cyber blogNews

Jul 15, 2026

GodDamn Ransomware Blinds EDR With the Microsoft-Signed PoisonX Driver - Alpha Cyber

A malicious Microsoft-signed kernel driver used to kill antivirus/EDR processes, strip security agents of required rights, or tamper with kernel notification records so defenses stop receiving events and go blind.

security online infoNews

Jul 15, 2026

GodDamn Ransomware Is a Beast Rebrand That Kills EDR

A malicious Microsoft-signed kernel driver used to disable endpoint defenses by killing security processes and removing user-mode API hooks before ransomware deployment.

cyberveilleNews

Jul 14, 2026

GodDamn ransomware : troisième rebranding de Monster/Beast par le groupe Hyadina | CyberVeille

Kernel driver used to disable endpoint defenses during the attack prior to final deployment of GodDamn ransomware.

scworldNews

Jul 10, 2026

‘GodDamn’ ransomware deploys PoisonX driver to kill EDR | news | SC Media

A malicious kernel driver used to disable endpoint defenses, including killing security services such as CrowdStrike Falcon, and used by GodDamn operators for defense evasion.

+11 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching58

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping25

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

PoisonX