Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses PoisonX Signed Kernel Driver to Disable Endpoint Defenses
Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses (TL-2026-2409), also tracked as GodDamn Ransomware, is a critical-severity ransomware operation, first published 2026-09-08. It is attributed to Hyadina (Russia) with high confidence, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1003, T1021, T1036), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-2409
- Threat ID
- TL-2026-2409
- Also known as
- GodDamn Ransomware, Beast Ransomware (rebrand), Monster Ransomware (lineage), God8Damn, BEAST LEAKS
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-09-08
- Last reviewed
- 2026-09-08
- Attribution
- Hyadina
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- health, manufacturing, education, government administration, information technology, consumer discretionary, industrials, construction, business services
- Target regions
- united states of america, Europe, Asia, Latin America
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses
Malware and tooling: AnyDesk, MimiKatz, beast, Advanced IP Scanner, PSEXEC, SoftPerfect NetScan, Tor - S0183
The Russian-speaking RaaS operator Hyadina has rebranded its Beast ransomware as 'GodDamn', first spotted in the wild on May 21, 2026. In a June 2026 incident, operators deployed a malicious Microsoft-signed kernel driver (PoisonX/g11.sys) to terminate endpoint security processes and strip kernel-mode protections before deploying the GodDamn encryptor. The attack chain involved AnyDesk remote access, a 14-tool NirSoft credential-harvesting suite, PsExec lateral movement to 10+ hosts, and AES-256-CBC+RSA-2048 file encryption with a .God8Damn extension. The PoisonX driver was also adopted by the Gentlemen RaaS operation in its GentleKiller EDR-killing framework.
How Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses works
GodDamn is the third iteration of a ransomware lineage operated by the financially motivated Russia-based actor Hyadina, evolving from Monster (Delphi-based RaaS, March 2022) through Beast (cross-platform RaaS with Linux/VMware ESXi support, June 2024) to GodDamn (first observed May 21, 2026). The malware represents a significant escalation in defensive evasion capability through the use of PoisonX, a malicious kernel driver that its developers successfully obtained a valid Microsoft Windows Hardware Compatibility Publisher signature for, enabling it to bypass Windows code-signing trust and auto-load as a kernel driver.
In a detailed incident analyzed by Symantec's Threat Hunter Team from early June 2026, the attack chain began with an unknown initial access vector. By May 29, anyDesk had been manually installed in a non-standard path under the user's Music folder, providing persistent remote access. On May 30, operators deployed a defense-evasion tool disguised as symantec.exe from the same Music folder, which dropped the PoisonX kernel driver (g11.sys) into the Windows driver store. A 14-tool NirSoft-based credential harvesting toolkit was simultaneously deployed, containing Mimikatz, WebBrowserPassView, ChromePass, PasswordFox, MessengerPass, VNCPassView, MailPassView, SniffPass, OperaPassView, CredentialsFileView, WirelessKeyView, ExtPassword, PSTPassword, and NetPass, alongside NetScan for network mapping.
On June 1, operators used PsExec to move laterally across the network, reaching at least 10 hosts. All commands were routed through the psexesvc.exe process chain. Windows Defender real-time monitoring was disabled, and administrative shares were mounted with stolen credentials. On each host, AnyDesk was installed as two auto-start Windows services with a suppressed interactive consent prompt and a pre-configured remote access password. By the end of June 2, this deployment had been completed across the victim environment. On June 3, the GodDamn ransomware binary (encrypter-windows-gui-x86.exe) was detected on a separate network segment belonging to a distinct organizational unit, where it began encrypting files with the victim organization's name as the file extension (rather than the .God8Damn extension used in other Hyadina attacks).
PoisonX (g11.sys) operates at kernel level, sending crafted IOCTL commands to terminate security product processes and remove user-mode API hooks, effectively blinding EDR tools while they appear to remain running. The driver was first documented in early 2026 being used to disable the CrowdStrike Falcon service. It was published to GitHub on April 7, 2026, by an author using the alias 'oxfemale', described as a research tool. The driver has also been adopted by the Gentlemen RaaS operation, which packages it as the G11 variant within its eight-driver GentleKiller EDR-killing framework, targeting 400+ processes from approximately 48 security vendors.
GodDamn uses a hybrid cryptosystem: per-file AES-256-CBC encryption with a unique random IV, with the symmetric key wrapped using RSA-2048 with PKCS#1 v1.5 padding. Encrypted files are renamed with the .God8Damn extension (or the victim's organization name) and a ransom note (README.TXT) instructs victims to contact the attackers via email (God8Damn@hotmail.com, god8damn@cyberfear.com) or the qTox encrypted messaging application. The Beast ransomware data leak site, operating on Tor (beast6azu4f7fxjaki[...].onion), supports double extortion by publishing stolen data from victims who do not pay.
Hyadina's RaaS operation has been active since 2022, initially marketing Monster on the Russian Anonymous Marketplace (RAMP). The Beast variant was first promoted on RAMP in June 2024, with an offline builder introduced in August 2024 supporting Windows, NAS, and VMware ESXi targets. The group avoids targeting systems in Commonwealth of Independent States (CIS) countries (Russia, Belarus, Kazakhstan, etc.) as well as several other nations, checking locale via GetLocaleInfo/GetSystemDefaultUILanguage. A Team Cymru analysis of an exposed Beast operator C2 server (5.78.84.144:8000, Hetzner AS212317) in March 2026 revealed the full toolkit including MEGAsync and WinSCP for data exfiltration, Volume Shadow Copy deletion scripts, and both Windows and Linux encryptors. The Beast data leak site, active since July 2025, has claimed over 100 victims across manufacturing, healthcare, education, government, and other sectors.
MITRE ATT&CK techniques used in TL-2026-2409
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Lateral Movement
Defense Evasion
Discovery
T1046 Network Service Discovery
Exfiltration
T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1569 System Services
Initial Access
T1133 External Remote Services
command-and-control
Impact
T1489 Service Stop; T1490 Inhibit System Recovery
Persistence
T1543 Create or Modify System Process
discovery
T1614 System Location Discovery
defense-impairment
Affected products and versions in Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses
- Microsoft — Windows
Vulnerable versions: 7; 8; 10; 11; Server 2016; Server 2019; Server 2022; Server 2025 - VMware — ESXi
Vulnerable versions: All versions supported by Beast encryptor - Linux — Linux (x64, x86 servers)
Vulnerable versions: Multiple distributions via Beast Linux encryptor - CrowdStrike — Falcon Sensor
Vulnerable versions: All versions prior to PoisonX-specific IOCTL detection
Remediation for Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses
Patches
- Ensure Microsoft Vulnerable Driver Blocklist is current on all Windows systems
Immediate actions
- Block known IOC domains, IPs, and email addresses at perimeter
- Deploy EDR behavioral detections for suspicious kernel driver loads (g11.sys, PoisonX.sys)
- Monitor for AnyDesk installations from non-standard paths (e.g., Music, Downloads folders)
- Audit and block PsExec execution where not business-justified
- Check for NirSoft tool suite presence and unauthorized credential harvesting tools
Workarounds
- Restrict administrative share access (ADMIN$, C$) to authorized users only
- Disable or restrict remote access tools (AnyDesk, TeamViewer) to approved use cases
- Enforce multi-factor authentication for all remote access
- Implement RDP and SMB logging with alerting for anomalous lateral movement
Longer-term hardening
- Implement driver blocklist policies via Windows Defender Application Control (WDAC) or AppLocker
- Deploy and maintain Microsoft Vulnerable Driver Blocklist updates across all endpoints
- Implement network segmentation to limit lateral movement via SMB/PsExec
- Deploy application allowlisting to prevent unauthorized binaries
- Enable PowerShell logging, constrained language mode, and script block logging
- Implement 24/7 SOC monitoring for BYOVD attack patterns
- Maintain offline, immutable backups with regular restore testing
Timeline of Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses
- Monster ransomware (predecessor to Beast/GodDamn) first observed in the wild; Delphi-based RaaS promoted on the Russian Anonymous Marketplace (RAMP) forum
- Beast ransomware first promoted on RAMP as a rebrand of Monster, adding Linux and VMware ESXi targeting, cross-platform encryptors, and improved encryption speed
- Beast introduces offline builder for affiliates, supporting Windows, NAS, and VMware ESXi payloads without requiring live C2 connection
- Beast ransomware launches Tor-based data leak site (BEAST LEAKS) for double extortion, hosting stolen victim data on .onion services
- Beast ransomware operations temporarily paused; resumed in January 2026 with continued victim postings to the Beast leak site
- PoisonX kernel driver published to GitHub by author 'oxfemale', described as a research tool; later weaponized by Hyadina and Gentlemen RaaS
- GodDamn ransomware first observed in the wild; code analysis confirms it is the latest rebrand of Beast, continuing the Hyadina-operated ransomware lineage
- Earliest confirmed activity in the Symantec-analyzed incident: AnyDesk manually installed in a user's Music folder, providing persistent remote access to the attacker
- Attackers deploy symantec.exe (masquerading as a Symantec product) which drops PoisonX (g11.sys) kernel driver; 14-tool NirSoft credential harvesting suite and NetScan deployed on a second host
- PsExec used for lateral movement across the network; Windows Defender real-time monitoring disabled; administrative shares mounted with stolen credentials
- AnyDesk installed as two auto-start Windows services on 10+ hosts; attackers terminate AnyDesk and reboot each host; pre-staged PowerShell scripts handle automated setup on some machines
- GodDamn ransomware (encrypter-windows-gui-x86.exe) detected on a separate network segment; files encrypted with victim organization's name as extension; ransom note (README.TXT) left with qTox and email contact details
- QuoIntelligence Week 29 snapshot and Symantec/Broadcom protection bulletin publicly disclose the GodDamn campaign and PoisonX signed driver technique
Sources cited for Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses
- Symantec/Broadcom: GodDamn Ransomware — Latest Beast Rebrand Uses Malicious Driver to Disable Defenses
- The Hacker News: GodDamn Ransomware Uses PoisonX Driver to Blind Security Software
- Security Affairs: GodDamn Ransomware Uses PoisonX to Blind Security Software
- QuoIntelligence: Threat Intelligence Snapshot — Week 29 of 2026
- Team Cymru: Beast Ransomware Server Toolkit Analysis
- ASEC AhnLab: Beast Ransomware Analysis
- SOCRadar: Dark Web Profile — Beast Ransomware
- Malpedia (Fraunhofer FKIE): win.beast
- BleepingComputer: Gentlemen Ransomware Uses Multiple EDR Killers
- The Hacker News: The Gentlemen RaaS Uses GentleKiller EDR Framework
- Mallory.ai: Hyadina Actor Profile
- Cyberint: The Nature of the Beast Ransomware
- Security.com: GodDamn Ransomware — Beast Rebrand Threat Intelligence
- CYBERCRIME.works: Beast Group Profile
More in ransomware
- Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass
- DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec References
- Vexy Ransomware hits Mega Velocity — 46.68 GB exfiltrated, double extortion
- Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026)
- Vexy Ransomware (RaaS) claims Sancity (sancity.in) — Indian real estate/construction group; 130 MB data exfiltration alleged
Detection coverage for TL-2026-2409
As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2409 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.