Cybersecurity researchers have identified a new ransomware strain called GodDamn, which uses an advanced defense evasion technique to disable security software before encrypting victims’ systems. The malware leverages the PoisonX kernel driver, allowing attackers to bypass endpoint protection through a technique known as Bring Your Own Vulnerable Driver (BYOVD).
GodDamn Ransomware Linked to Earlier Malware Families
Researchers reported that GodDamn was first observed in the wild on May 21, 2026. Analysis suggests it is a rebranded version of the Beast ransomware, which itself evolved from the Monster ransomware first identified in 2022.
The ransomware is believed to be developed by a threat actor tracked under the name Hyadina, indicating continued improvements to its malware capabilities.
Attack Chain: Remote Access, Credential Theft, and Lateral Movement
In an attack observed during early June 2026, attackers gained remote access using AnyDesk. While the initial access method remains unknown, they deployed a credential-stealing toolkit before launching the ransomware.
The toolkit was designed to collect sensitive information from several sources, including:
- Web browsers
- Windows Credential Manager
- Cached domain credentials
- VNC sessions
- Email clients
- Saved Wi-Fi profiles
- Live network traffic
The stolen credentials enabled attackers to move further across the compromised network.
PoisonX Driver Disables Security Software
One of the most concerning aspects of the attack is the use of the PoisonX kernel driver together with a user-mode tool disguised as symantec.exe.
The attackers used these components to disable antivirus (AV) and endpoint detection and response (EDR) solutions before deploying the ransomware.
Unlike many BYOVD attacks that rely on vulnerable but legitimate drivers, PoisonX is believed to be a malicious driver that was successfully signed, allowing it to load without immediately triggering security warnings.
Once active, the driver can:
- Terminate antivirus and EDR processes
- Remove permissions required by security software
- Modify kernel-level functions
- Prevent security tools from detecting malicious activity
These actions make it much harder for security solutions to detect or stop the ransomware.
Remote Access Expanded Across the Network
After compromising the initial system, the attackers used PsExec to move laterally across the network.
They installed AnyDesk on each accessible host and configured it to launch automatically as a Windows service, ensuring persistent remote access after system reboots.
Investigators also found PowerShell scripts that automated the installation process, allowing the attackers to deploy the software quickly across multiple devices.
The same deployment routine was repeated on at least 10 systems before the ransomware payload was executed.
File Extensions and Ransom Note
GodDamn ransomware usually appends the .God8Damn extension to encrypted files. In some incidents, however, encrypted files were renamed using the victim organization’s name instead, suggesting the malware can be customized for targeted attacks.
Victims are instructed to contact the attackers through either email or the qTox encrypted messaging platform.
Malware Continues to Evolve
The use of the PoisonX driver demonstrates that the operators behind GodDamn are actively improving their ransomware toolkit.
By disabling security software at the kernel level before encryption begins, attackers significantly increase the chances of a successful attack while reducing opportunities for defenders to detect malicious activity.
How Organizations Can Reduce the Risk
To protect against advanced ransomware threats, organizations should:
- Keep operating systems and security software updated.
- Restrict administrator privileges whenever possible.
- Monitor for unauthorized kernel driver installations.
- Enable driver blocklists and exploit protection features.
- Limit the use of remote administration tools unless necessary.
- Monitor PowerShell activity and credential dumping attempts.
- Maintain secure, offline backups and test recovery procedures regularly.
Final Thoughts
The emergence of GodDamn ransomware highlights the growing sophistication of modern ransomware campaigns. By combining credential theft, remote administration tools, lateral movement, and kernel-level defense evasion using the PoisonX driver, attackers are becoming increasingly effective at bypassing traditional security measures.
Organizations should adopt layered security strategies, closely monitor endpoint activity, and prepare incident response plans to reduce the impact of these evolving threats.
