God Damn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses
Summary: Symantec's Threat Hunter Team reports that a ransomware family called GodDamn, first seen in the wild on May 21, 2026, uses the PoisonX kernel driver to disable endpoint defenses, and assesses it as a rebrand of Beast, itself an enhanced Monster variant traced to a developer tracked as Hyadina. In an early June 2026 attack, the operators used AnyDesk for remote access and a NirSoft-based credential harvester before deploying the ransomware, and by June 2 had repeated an AnyDesk deployment sequence across at least 10 hosts in the targeted organization.
Why it matters: PoisonX is described as a malicious driver whose developers got it signed by Microsoft, so Windows loads it automatically once an attacker has administrator rights - the same driver appears among the eight used in The Gentlemen RaaS scheme's GentleKiller tool. A signed driver that kills or blinds EDR leaves the endpoint reporting healthy while it is stripped of defenses.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026