GodDamn Ransomware Blinds EDR With the Microsoft-Signed PoisonX Driver
GodDamn is a fresh rebrand of the Beast/Monster ransomware lineage that switches off endpoint defenses before it encrypts.
- Ransomware
Bottom line. GodDamn’s whole playbook is to make your EDR blind, then encrypt. It loads the PoisonX kernel driver (g11.sys), a malicious driver that carries a valid Microsoft signature, so Windows loads it automatically, in a BYOVD attack to kill or neuter security agents, backed by a user-mode killer masquerading as a Symantec binary. Priority defenses: enforce Microsoft’s Vulnerable Driver Blocklist plus HVCI/Memory Integrity, alert on any EDR that suddenly stops reporting, restrict AnyDesk and PsExec, and keep tested offline backups.
Background
GodDamn ransomware was first seen in the wild on 21 May 2026 and is assessed as a rebrand of Beast, itself an enhanced version of Monster, a Delphi-based ransomware that surfaced in March 2022. The developer behind the whole Monster -> Beast -> GodDamn lineage is tracked under the moniker Hyadina, and the group is actively iterating: GodDamn’s use of the newly surfaced PoisonX driver marks a clear escalation in its defense-evasion capability.
In a June 2026 intrusion, the operators used AnyDesk for remote access and ran a NirSoft-based credential-harvesting toolkit before deploying the ransomware. The initial access vector was not established. What makes this campaign notable is not novelty in the encryptor but the lengths the crew goes to in order to disable protection first, combining a signed malicious kernel driver, a fake-Symantec user-mode killer, and hands-on lateral movement.
What we observed
The intrusion is built around disabling defenses before impact:
- A signed malicious driver (the escalation): PoisonX ships as g11.sys and is unusual because it appears to be a malicious driver whose developers succeeded in getting it signed by Microsoft. Because it is validly signed, Windows loads it automatically, and once in the kernel it kills antivirus/EDR processes, strips the security agent of the rights it needs to function, or tampers with kernel notification records so the product stops receiving events and goes blind. PoisonX is also one of eight drivers bundled into The Gentlemen RaaS ‘GentleKiller’ tool.
- Belt-and-suspenders evasion: alongside the kernel driver, a user-mode defense-evasion tool is dressed up as a legitimate Symantec product (symantec.exe) to further disable endpoint protection.
- Credentials first: a NirSoft-based harvesting toolkit extracts secrets from web browsers, Windows Credential Manager, cached domain credentials, VNC sessions, email clients and Wi-Fi profiles, and even captures live network traffic, all before the encryptor runs.
- Hands-on spread and persistence: PsExec drives lateral movement; AnyDesk is then installed on each reachable host and registered as an auto-start Windows service to survive reboots, with some machines set up entirely by a pre-staged PowerShell installer. The operators terminate AnyDesk, wait, and reboot, a sequence repeated across at least 10 hosts in the target within roughly a day.
- Impact and branding: the encryptor renames files using the victim’s name or a ‘.God8Damn’ extension, and the ransom note directs victims to make contact by email or via the qTox encrypted messaging app.
GodDamn intrusion chain
Every step before encryption exists to remove or blind your defenses, so detect the disabling, not just the encryptor.
Attribution
The Monster -> Beast -> GodDamn family is attributed to a developer tracked as Hyadina; this is financially motivated cybercrime with no state alignment established. The lineage and rebrand assessment come from the Symantec Threat Hunter Team and are corroborated by CYFIRMA reporting. Confidence in the family lineage and the PoisonX/BYOVD tradecraft is high; as with any fast-moving criminal brand, expect the specific binaries, driver builds and extensions to change while the disable-defenses-then-encrypt pattern stays constant.
Confidence: 85%.
GodDamn doesn’t fight your EDR. It gets Microsoft to sign the driver that switches it off.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Command and Control | Remote Access Software | T1219 | AnyDesk is used for interactive remote access and re-deployed across hosts. |
| Credential Access | Credentials from Password Stores | T1555 | A NirSoft-based toolkit harvests browser, Windows Credential Manager, VNC and email-client credentials. |
| Credential Access | Network Sniffing | T1040 | The harvesting toolkit also captures live network traffic. |
| Defense Evasion | Impair Defenses: Disable or Modify Tools | T1562.001 | PoisonX (g11.sys) and a fake-Symantec user-mode tool (symantec.exe) kill, strip or blind AV/EDR (BYOVD). |
| Persistence | Boot or Logon Autostart Execution: Kernel Modules and Extensions | T1547.006 | The validly Microsoft-signed PoisonX driver is loaded into the Windows kernel. |
| Lateral Movement | System Services: Service Execution | T1569.002 | PsExec is used to move laterally and execute across reachable hosts. |
| Persistence | Create or Modify System Process: Windows Service | T1543.003 | AnyDesk is registered as an auto-start Windows service to survive reboots. |
| Impact | Data Encrypted for Impact | T1486 | The encryptor renames files with the victim name or a ‘.God8Damn’ extension and drops a ransom note. |
Detection
Copy-ready hunting query:
# Hunt for the GodDamn / PoisonX BYOVD ransomware chain
# 1) BYOVD: new kernel-driver service creation and the PoisonX driver by name
index=edr (event_id=7045 service_type="kernel mode driver") OR (file_name="g11.sys") OR (image_load path="*g11.sys")
# 2) Fake-Symantec user-mode killer running from a non-Symantec path
index=edr process_name="symantec.exe" AND NOT process_path="*\\Program Files*\\Symantec*"
# 3) EDR/AV tamper: security service stop/kill or sudden loss of endpoint telemetry
index=edr (event="service_stop" service IN ("*Defender*","*Sense*","*CrowdStrike*","*SentinelOne*","*Symantec*")) OR event="edr_selfprotect_tamper" OR agent_heartbeat_lost=true
# 4) Living-off-the-land: PsExec service (PSEXESVC) and AnyDesk installed as an auto-start service
index=edr (event_id=7045 service_name IN ("PSEXESVC","AnyDesk")) OR (process_name="anydesk.exe" command_line="*-install*")
# 5) Impact: mass renames to .God8Damn and NirSoft credential-tool artifacts
index=edr (file_name="*.God8Damn") OR (process_name IN ("*WebBrowserPassView*","*mailpv*","*netpass*","*SniffPass*","*VNCPassView*"))
# NOTE: specific file hashes and network IOCs are in the Symantec Threat Hunter Team report; load them into your SIEM/EDR as they become available.Recommendations
- Kill BYOVD at the root: enable Microsoft’s Vulnerable/Blocklisted Driver policy and HVCI (Memory Integrity), enforce WDAC or attack-surface-reduction rules for driver loading, and add PoisonX (g11.sys) to your driver blocklist even though it is signed, a valid signature is not a trust decision.
- Detect the blinding, not just the encryptor: alert on AV/EDR service stops, self-protection tampering, and any endpoint that abruptly stops sending telemetry; a silent agent is a red flag, not a healthy one.
- Constrain the hands-on tools: restrict and monitor AnyDesk and PsExec, alert on AnyDesk installed as a new auto-start service and on PSEXESVC creation, and block unsanctioned remote-access software at the endpoint and perimeter.
- Contain credential theft: assume browser, Credential Manager, VNC, email and Wi-Fi credentials were harvested, reset passwords, rotate secrets and service accounts, and hunt for NirSoft tool artifacts.
- Be ready for encryption: keep tested offline/immutable backups and rehearse an IR plan; the note routes victims to email or qTox, so engage incident response and law enforcement rather than negotiating blind, and treat any ‘.God8Damn’ rename as an active-encryption incident.
