GodDamn Ransomware Rebrands From Beast and Uses PoisonX Driver to Disable Defenses

GodDamn ransomware has emerged as a serious threat, marking the third rebrand of a family that has quietly evolved since 2022.

What makes this variant stand out is not just its encryption ability but the malicious kernel driver it uses to blind security tools before an attack begins. This mix of stealth and persistence lets operators move through networks with alarming ease.

The attackers behind GodDamn rely on a familiar playbook of remote access tools, credential theft utilities, and lateral movement techniques, but they added a dangerous layer of defense evasion.

By deploying a signed but malicious driver alongside a fake security tool, they disable endpoint protection at the kernel level, far harder for defenders to catch than typical malware behavior.

This approach has already proven effective in a real intrusion investigated by researchers. Analysts from Symantec identified the connection between GodDamn and its predecessors, tracing a direct lineage back to the Monster ransomware first observed in 2022.

The Threat Hunter Team, part of Symantec and Carbon Black, said in a report shared with Cyber Security News (CSN) that the developer behind these ransomware families, tracked as Hyadina, continues refining its tools with each rebrand.

The impact of this activity has been significant for the organization targeted in the investigated incident, with attackers gaining a foothold on one machine and spreading to at least ten hosts before deploying ransomware.

The four day gap between initial access and encryption suggests the group used this time for reconnaissance, credential harvesting, or data theft.

GodDamn is not an entirely new creation but the latest name applied to a lineage that has adapted repeatedly to survive. Understanding its origins and current techniques helps explain why detecting this threat quickly matters so much for network defenders.

GodDamn Ransomware Rebrands From Beast and Uses PoisonX Driver

GodDamn traces its roots to Monster, a ransomware strain written in Delphi that first appeared in March 2022 and targeted 32-bit Windows systems while avoiding machines in the Commonwealth of Independent States.

Hyadina ran Monster as a ransomware-as-a-service operation, working with affiliates using Mimikatz and a range of NirSoft password recovery tools.

In June 2024, the group rebranded as Beast, expanding support to Linux and VMware ESXi systems and improving the encryption process itself.

Beast also introduced multilingual support, including Chinese, showing the operators were widening their pool of victims beyond earlier limitations.

By 2025, Beast attacks incorporated new tools such as the Gmer rootkit scanner for killing processes, Defender Control for disabling Windows Defender, and IObit Unlocker for freeing locked files.

GodDamn continues this pattern, and in some cases renames encrypted files with the extension .God8Damn, though in the investigated case files were instead renamed using the victim organization’s name.

PoisonX driver disables defenses

The most notable addition in this GodDamn attack was the PoisonX kernel driver, first documented earlier in 2026 when it was used to kill the CrowdStrike Falcon service through a crafted command sent to its hidden interface.

Since the driver carries a legitimate Microsoft signature, it appears trustworthy to the operating system despite its malicious purpose.

This is not a typical bring-your-own-vulnerable-driver scenario where attackers exploit a flaw in existing software.

Instead, PoisonX appears built specifically for malicious use and somehow obtained a valid Microsoft signature, letting it terminate security processes and strip protective hooks at the kernel level.

In the investigated attack, the driver was dropped alongside a fake file named symantec.exe, designed to impersonate a trusted security product while quietly disabling Windows Defender’s real-time monitoring.

Attackers then used PsExec to push commands across the network, install AnyDesk on multiple hosts for persistent access, and launch the ransomware binary itself.

Given the sophistication of this toolset, organizations should watch for unauthorized kernel driver installs, restrict tools like AnyDesk to approved configurations, and keep endpoint detection updated against BYOVD style techniques.

Reviewing the Symantec Protection Bulletin for the latest detection signatures is also recommended for teams defending against this threat.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOC Teams.