GodDamn Ransomware Uses Signed PoisonX Driver to Disable Defenses

The Hyadina ransomware operation has deployed its newly rebranded GodDamn locker against U.S. organizations, using a signed kernel driver called PoisonX to weaken endpoint protections before encryption. Symantec linked GodDamn to the earlier Beast and Monster ransomware families, describing it as the latest rebrand in the same lineage. In the investigated intrusion, the attackers used AnyDesk for remote access, PsExec for lateral movement, and a broad credential-theft toolkit built around Mimikatz and multiple NirSoft utilities, while also using a fake Symantec-branded evasion tool to install the malicious driver.

PoisonX, signed through Microsoft’s Hardware Compatibility process, was used in a bring your own vulnerable driver-style tactic to terminate security processes and remove user-mode API hooks, reducing the effectiveness of endpoint defenses. Symantec said the attackers established persistence and unattended remote access across at least 10 hosts before ransomware binaries were detected, with suspicious AnyDesk activity preceding lateral movement and final deployment by several days. Researchers said the case shows Hyadina’s increasing reliance on dual-use and open-source tools, while also underscoring concerns that Microsoft’s vulnerable driver blocklist may not immediately cover newly identified malicious or dangerous drivers.