# GodDamn Ransomware (Hyadina) — Third Rebrand from Monster/Beast, Deploys Signed PoisonX Kernel Driver

> Hyadina, a ransomware-as-a-service operation active since March 2022, has rebranded its locker for the third time (Monster -> Beast -> GodDamn), first documented May 21, 2026. GodDamn encrypts victim files (typically the .God8Damn extension or the victim organization's own name) and is deployed alongside PoisonX, a malicious kernel-mode driver (g11.sys) that carries a legitimate Microsoft Hardware Compatibility signature and is used in a BYOVD attack to kill security processes and strip EDR/AV tooling of kernel-level visibility.

- **Published:** 2026-07-09T00:00:00Z
- **Last reviewed:** 2026-10-27T16:16:36.546Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1148
- **ID:** TL-2026-1148
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Hyadina
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GodDamn is the latest rebrand of the Hyadina ransomware-as-a-service operation, tracing a lineage from Monster (first observed March 2022, Delphi-written, 32-bit Windows-only, deliberately avoided CIS-region targets) to Beast (June 2024, added Linux/VMware ESXi support, stronger encryption, and multilingual builds including Chinese-language variants) to GodDamn (first documented May 21, 2026). The defining evolution in GodDamn is the integration of PoisonX (file g11.sys, SHA-256 2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d), a malicious kernel driver that its developers succeeded in getting Microsoft to sign via the Windows Hardware Compatibility Program. Because the driver carries a legitimate Microsoft signature, Windows loads it automatically once dropped by an attacker with administrator privileges, making it a textbook Bring-Your-Own-Vulnerable-Driver (BYOVD) defense-evasion tool. PoisonX operates at kernel level to terminate security-related processes, strip endpoint security agents of the rights/hooks they need to function, and tamper with kernel structures to blind AV/EDR tooling — effectively disabling Windows Defender real-time protection and other installed security products. Alongside the driver, the intrusion set deploys a user-mode decoy binary masquerading as "symantec.exe" to further mislead defenders and disable legitimate Symantec/Broadcom protections. Symantec's Threat Hunter Team investigated a real-world intrusion in which the attacker gained initial access, then spent roughly four days conducting reconnaissance, credential harvesting, and lateral movement before deploying the encryptor, ultimately reaching more than ten hosts in the environment. The toolkit is a fairly standard but comprehensive off-the-shelf RaaS affiliate loadout: PsExec for remote command execution and lateral tool transfer, AnyDesk (configured to auto-start as a Windows service) for persistent remote access, Mimikatz for credential dumping, and a large collection of NirSoft utilities (Netpass, WirelessKeyView, CredentialsFileView, MailPassView, ChromePass, PstPassword, MessengerPass, VNCPassView, OperaPassView, WebBrowserPassView, SniffPass, ExtPassword, PasswordFox) to harvest credentials from browsers, VPN clients, Wi-Fi profiles, email clients, and VNC sessions. Netscan was used for internal network discovery, and additional tools (Gmer rootkit scanner, Defender Control, IObit Unlocker) support further defense evasion and unlocking of files held open by other processes prior to encryption. Ransom communication with victims is conducted via email or the qTox encrypted messaging application, consistent with prior Hyadina operations. Notably, the PoisonX driver has also been observed adopted by a separate RaaS operation, The Gentlemen, via a related tool called GentleKiller, indicating the signed driver is being shared or resold within the ransomware-affiliate ecosystem as a commodity BYOVD defense-evasion capability. Victim targeting has expanded from Monster's CIS-avoidance policy to apparent international targeting, with GodDamn's multilingual capability (including Chinese-language support inherited from Beast) suggesting a broad affiliate targeting scope; documented intrusion activity in June 2026 targeted U.S. companies.

## MITRE ATT&CK

- T1133 External Remote Services
- T1569.002 System Services: Service Execution
- T1543.003 Create or Modify System Process: Windows Service
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1685.001 Disable or Modify Windows Event Log
- T1553.002 Subvert Trust Controls: Code Signing
- T1036.005 Match Legitimate Resource Name or Location
- T1014 Rootkit
- T1070 Indicator Removal
- T1003.001 OS Credential Dumping: LSASS Memory
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1552.001 Unsecured Credentials: Credentials In Files
- T1558 Steal or Forge Kerberos Tickets
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1016 System Network Configuration Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1021.001 Remote Services: Remote Desktop Protocol
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1040 Network Sniffing
- T1685.005 Clear Windows Event Logs
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions
- T1555.004 Credentials from Password Stores: Windows Credential Manager
- T1018 Remote System Discovery
- T1657 Financial Theft
- T1588 Obtain Capability
- T1068 Exploitation for Privilege Escalation
- T1562 Impair Defenses
- T1003 OS Credential Dumping

## Sources

- [GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses](https://thehackernews.com/2026/07/goddamn-ransomware-uses-poisonx-driver.html)
- [GodDamn Ransomware: Rebrands from Beast](https://cybersecuritynews.com/goddamn-ransomware-rebrands-from-beast/)
- ['GodDamn' Ransomware Uses BYOVD to Smite US Companies](https://www.darkreading.com/cyberattacks-data-breaches/goddamn-ransomware-byovd-smite-companies)
- [GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses](https://www.security.com/blog-post/goddamn-ransomware-beast-rebrand)
- [GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses (Protection Bulletin)](https://www.broadcom.com/support/security-center/protection-bulletin/goddamn-ransomware-latest-beast-rebrand-uses-malicious-driver-to-disable-defenses)
- [GodDamn Ransomware Attack Uses PsExec Lateral Movement and NirSoft Toolkit for Credential Theft](https://gbhackers.com/goddamn-ransomware-attack/amp/)
- [GodDamn Ransomware Uses Signed PoisonX Driver to Disable Defenses](https://www.mallory.ai/stories/019f465b-8f8c-757a-81e8-4065b5d71f3d)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1148