Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses PoisonX Signed Kernel Driver to Disable Endpoint Defenses

Key facts for GodDamn PoisonX signed driver

Detection coverage for GodDamn PoisonX signed driver

As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2409 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PsExec Lateral Movement with Concurrent Credential Harvesting Tool Execution

Detects PsExec.exe lateral movement activity correlated with credential harvesting tool execution (Mimikatz, NirSoft password recovery suite, WebBrowserPassView, ChromePass, WirelessKeyView, MailPassView, PasswordFox) and network reconnaissance tools (NetScan, Advanced IP Scanner) on the same host. Hyadina operators used PsExec to move laterally to 10+ hosts, then deployed a 14-tool NirSoft-based credential harvesting suite and NetScan for network mapping, with all commands routed through the psexesvc.exe service process chain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1021.002, T1003.001, T1555.003, T1046, T1059.001, T1569.002
• Data sources: sysmon, windows_security_4688, process_creation, windows_share_access_5145
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (
    Image="*\\PsExec.exe" OR Image="*\\PsExec64.exe"
    OR CommandLine="*psexec*" OR CommandLine="*psexesvc*"
    OR (Image="*\\psexesvc.exe")
  )
| stats values(Image) as PsExecImages values(CommandLine) as CmdLines values(ProcessId) as PsExecPids
  by ComputerName, User, _time
| append [search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (
    Image="*\\mimikatz.exe"
    OR Image="*\\WebBrowserPassView.exe"
    OR Image="*\\ChromePass.exe"
    OR Image="*\\PasswordFox.exe"
    OR Image="*\\MailPassView.exe"
    OR Image="*\\WirelessKeyView.exe"
    OR Image="*\\VNCPassView.exe"
    OR Image="*\\SniffPass.exe"
    OR Image="*\\OperaPassView.exe"
    OR Image="*\\CredentialsFileView.exe"
    OR Image="*\\NetScan.exe"
    OR Image="*\\advanced_ip_scanner.exe"
  )
  | stats values(Image) as CredToolImages by ComputerName, User, _time
  | eval CredentialToolset=true]
| stats values(PsExecImages) as PsExec_Binaries values(CmdLines) as PsExec_Commands values(CredToolImages) as Credential_Tools
  by ComputerName, User
| where mvcount(PsExec_Binaries) > 0
| eval DetectionType=case(
    mvcount(Credential_Tools) >= 3, "LATERAL MOVEMENT WITH EXTENSIVE CREDENTIAL HARVESTING",
    mvcount(Credential_Tools) >= 1, "LATERAL MOVEMENT WITH CREDENTIAL HARVESTING",
    1=1, "LATERAL MOVEMENT"
  )
| table ComputerName, User, DetectionType, PsExec_Binaries, PsExec_Commands, Credential_Tools

Microsoft KQL

let LateralMovement = (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "PsExec.exe" or FileName =~ "PsExec64.exe" or ProcessCommandLine has "psexec"
        or FileName =~ "psexesvc.exe"
    | project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, ProcessId
    | extend LateralMovementDetected = true
);
let CredentialTools = (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("mimikatz.exe", "WebBrowserPassView.exe", "ChromePass.exe", "PasswordFox.exe",
        "MailPassView.exe", "WirelessKeyView.exe", "VNCPassView.exe", "SniffPass.exe", "OperaPassView.exe",
        "CredentialsFileView.exe", "NetScan.exe", "advanced_ip_scanner.exe")
    | project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, ProcessId
    | extend CredentialHarvestingDetected = true
);
LateralMovement
| join kind=inner (
    CredentialTools
    | summarize CredentialTools = make_set(FileName), EarliestTool = min(Timestamp) by DeviceName
) on DeviceName
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, CredentialTools
| sort by Timestamp desc

Sigma

title: PsExec Lateral Movement with Credential Harvesting Tool Execution
id: a91b4c3d-7e5f-4a1b-8f3a-7e6d5c4b3a2d
status: experimental
description: Detects PsExec used for lateral movement in conjunction with credential harvesting tools
  (Mimikatz, NirSoft password recovery tools) and network reconnaissance tools on the same host.
  Hyadina operators used PsExec to move laterally to 10+ hosts, deploying a 14-tool credential harvesting
  suite including Mimikatz, WebBrowserPassView, ChromePass, and WirelessKeyView.
references:
  - https://www.broadcom.com/support/security-center/protection-bulletin/goddamn-ransomware-latest-beast-rebrand-uses-malicious-driver-to-disable-defenses
  - https://www.team-cymru.com/post/beast-ransomware-server-toolkit-analysis
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1003/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-08
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.credential_access
  - attack.t1003.001
  - attack.t1555.003
  - attack.t1046
  - attack.t1059.001
  - attack.execution
  - attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    - Image|endswith: '\PsExec.exe'
    - Image|endswith: '\PsExec64.exe'
    - Image|endswith: '\psexesvc.exe'
    - CommandLine|contains: 'psexec'
  selection_cred_tools:
    - Image|endswith: '\mimikatz.exe'
    - Image|endswith: '\WebBrowserPassView.exe'
    - Image|endswith: '\ChromePass.exe'
    - Image|endswith: '\PasswordFox.exe'
    - Image|endswith: '\MailPassView.exe'
    - Image|endswith: '\WirelessKeyView.exe'
    - Image|endswith: '\NetScan.exe'
    - Image|endswith: '\advanced_ip_scanner.exe'
  condition: selection_psexec and selection_cred_tools
falsepositives:
  - Authorized IT administration using PsExec alongside credential auditing tools
  - Penetration testing and red team exercises
level: critical

Known false positives:

• Authorized IT administration using PsExec alongside credential auditing tools
• Penetration testing and red team exercises

Tuning notes: Baseline known administrative PsExec usage and exclude approved IT admin accounts. Correlation with Sysmon EventCode 3 (network connection) to IPs outside the authorized management subnet increases fidelity. Adjust threshold to require at least 2 distinct credential tools on the same host within 24h of PsExec execution.

• 🔒 AnyDesk Non-Standard Installation and Persistence — KQL · unlock with TL Creds
• 🔒 PoisonX Malicious Kernel Driver Load — KQL · unlock with TL Creds
• 🔒 PsExec Lateral Movement with NirSoft Credential Harvesting — KQL · unlock with TL Creds
• 🔒 AnyDesk Remote Access Tool from Non-Standard Path — Sigma · unlock with TL Creds
• 🔒 PoisonX ([indicator]) BYOVD Kernel Driver Load — Sigma · unlock with TL Creds
• 🔒 PsExec Lateral Movement with Credential Dumping Toolset — Sigma · unlock with TL Creds
• 🔒 AnyDesk Remote Access Tool Installed from Non-Standard Path · unlock with TL Creds
• 🔒 PoisonX Signed Kernel Driver Load ([indicator]) — BYOVD EDR Bypass · unlock with TL Creds

Indicators of compromise for GodDamn PoisonX signed driver

As of 2026-09-08, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-2409.

Sample indicators (3 of 25)

• IP address: 5.78.84[.]144
• Domain: beast6azu4f7fxjaki[.]onion
• URL: hxxps://iplogger[.]co/1v1i85.torrent

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

How GodDamn PoisonX signed driver works

The attack chain involved AnyDesk remote access, a 14-tool NirSoft credential-harvesting suite, PsExec lateral movement to 10+ hosts, and AES-256-CBC+RSA-2048 file encryption with a .God8Damn extension. The PoisonX driver was also adopted by the Gentlemen RaaS operation in its GentleKiller EDR-killing framework.

GodDamn is the third iteration of a ransomware lineage operated by the financially motivated Russia-based actor Hyadina, evolving from Monster (Delphi-based RaaS, March 2022) through Beast (cross-platform RaaS with Linux/VMware ESXi support, June 2024) to GodDamn (first observed May 21, 2026). The malware represents a significant escalation in defensive evasion capability through the use of PoisonX, a malicious kernel driver that its developers successfully obtained a valid Microsoft Windows Hardware Compatibility Publisher signature for, enabling it to bypass Windows code-signing trust and auto-load as a kernel driver.

In a detailed incident analyzed by Symantec's Threat Hunter Team from early June 2026, the attack chain began with an unknown initial access vector. By May 29, anyDesk had been manually installed in a non-standard path under the user's Music folder, providing persistent remote access. On May 30, operators deployed a defense-evasion tool disguised as symantec.exe from the same Music folder, which dropped the PoisonX kernel driver (g11.sys) into the Windows driver store. A 14-tool NirSoft-based credential harvesting toolkit was simultaneously deployed, containing Mimikatz, WebBrowserPassView, ChromePass, PasswordFox, MessengerPass, VNCPassView, MailPassView, SniffPass, OperaPassView, CredentialsFileView, WirelessKeyView, ExtPassword, PSTPassword, and NetPass, alongside NetScan for network mapping.

On June 1, operators used PsExec to move laterally across the network, reaching at least 10 hosts. All commands were routed through the psexesvc.exe process chain. Windows Defender real-time monitoring was disabled, and administrative shares were mounted with stolen credentials. On each host, AnyDesk was installed as two auto-start Windows services with a suppressed interactive consent prompt and a pre-configured remote access password. By the end of June 2, this deployment had been completed across the victim environment. On June 3, the GodDamn ransomware binary (encrypter-windows-gui-x86.exe) was detected on a separate network segment belonging to a distinct organizational unit, where it began encrypting files with the victim organization's name as the file extension (rather than the .God8Damn extension used in other Hyadina attacks).

PoisonX (g11.sys) operates at kernel level, sending crafted IOCTL commands to terminate security product processes and remove user-mode API hooks, effectively blinding EDR tools while they appear to remain running. The driver was first documented in early 2026 being used to disable the CrowdStrike Falcon service. It was published to GitHub on April 7, 2026, by an author using the alias 'oxfemale', described as a research tool. The driver has also been adopted by the Gentlemen RaaS operation, which packages it as the G11 variant within its eight-driver GentleKiller EDR-killing framework, targeting 400+ processes from approximately 48 security vendors.

GodDamn uses a hybrid cryptosystem: per-file AES-256-CBC encryption with a unique random IV, with the symmetric key wrapped using RSA-2048 with PKCS#1 v1.5 padding. Encrypted files are renamed with the .God8Damn extension (or the victim's organization name) and a ransom note (README.TXT) instructs victims to contact the attackers via email (God8Damn@hotmail.com, god8damn@cyberfear.com) or the qTox encrypted messaging application. The Beast ransomware data leak site, operating on Tor (beast6azu4f7fxjaki[...].onion), supports double extortion by publishing stolen data from victims who do not pay.

Hyadina's RaaS operation has been active since 2022, initially marketing Monster on the Russian Anonymous Marketplace (RAMP). The Beast variant was first promoted on RAMP in June 2024, with an offline builder introduced in August 2024 supporting Windows, NAS, and VMware ESXi targets. The group avoids targeting systems in Commonwealth of Independent States (CIS) countries (Russia, Belarus, Kazakhstan, etc.) as well as several other nations, checking locale via GetLocaleInfo/GetSystemDefaultUILanguage. A Team Cymru analysis of an exposed Beast operator C2 server (5.78.84.144:8000, Hetzner AS212317) in March 2026 revealed the full toolkit including MEGAsync and WinSCP for data exfiltration, Volume Shadow Copy deletion scripts, and both Windows and Linux encryptors. The Beast data leak site, active since July 2025, has claimed over 100 victims across manufacturing, healthcare, education, government, and other sectors.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Lateral Movement

T1021 Remote Services

Defense Evasion

T1036 Masquerading

Discovery

T1046 Network Service Discovery

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter; T1569 System Services

Initial Access

T1133 External Remote Services

command-and-control

T1219 Remote Access Tools

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Persistence

T1543 Create or Modify System Process

discovery

T1614 System Location Discovery

defense-impairment

T1685 Disable or Modify Tools

Remediation for GodDamn PoisonX signed driver

Patches

• Ensure Microsoft Vulnerable Driver Blocklist is current on all Windows systems

Immediate actions

• Block known IOC domains, IPs, and email addresses at perimeter
• Deploy EDR behavioral detections for suspicious kernel driver loads (g11.sys, PoisonX.sys)
• Monitor for AnyDesk installations from non-standard paths (e.g., Music, Downloads folders)
• Audit and block PsExec execution where not business-justified
• Check for NirSoft tool suite presence and unauthorized credential harvesting tools

Workarounds

• Restrict administrative share access (ADMIN$, C$) to authorized users only
• Disable or restrict remote access tools (AnyDesk, TeamViewer) to approved use cases
• Enforce multi-factor authentication for all remote access
• Implement RDP and SMB logging with alerting for anomalous lateral movement

Longer-term hardening

• Implement driver blocklist policies via Windows Defender Application Control (WDAC) or AppLocker
• Deploy and maintain Microsoft Vulnerable Driver Blocklist updates across all endpoints
• Implement network segmentation to limit lateral movement via SMB/PsExec
• Deploy application allowlisting to prevent unauthorized binaries
• Enable PowerShell logging, constrained language mode, and script block logging
• Implement 24/7 SOC monitoring for BYOVD attack patterns
• Maintain offline, immutable backups with regular restore testing

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: 7; 8; 10; 11; Server 2016; Server 2019; Server 2022; Server 2025
• VMware — ESXi
  Vulnerable versions: All versions supported by Beast encryptor
• Linux — Linux (x64, x86 servers)
  Vulnerable versions: Multiple distributions via Beast Linux encryptor
• CrowdStrike — Falcon Sensor
  Vulnerable versions: All versions prior to PoisonX-specific IOCTL detection

Timeline of GodDamn PoisonX signed driver

• 2022-03-01 Monster ransomware (predecessor to Beast/GodDamn) first observed in the wild; Delphi-based RaaS promoted on the Russian Anonymous Marketplace (RAMP) forum
• 2024-06-01 Beast ransomware first promoted on RAMP as a rebrand of Monster, adding Linux and VMware ESXi targeting, cross-platform encryptors, and improved encryption speed
• 2024-08-01 Beast introduces offline builder for affiliates, supporting Windows, NAS, and VMware ESXi payloads without requiring live C2 connection
• 2025-07-01 Beast ransomware launches Tor-based data leak site (BEAST LEAKS) for double extortion, hosting stolen victim data on .onion services
• 2025-11-01 Beast ransomware operations temporarily paused; resumed in January 2026 with continued victim postings to the Beast leak site
• 2026-04-07 PoisonX kernel driver published to GitHub by author 'oxfemale', described as a research tool; later weaponized by Hyadina and Gentlemen RaaS
• 2026-05-21 GodDamn ransomware first observed in the wild; code analysis confirms it is the latest rebrand of Beast, continuing the Hyadina-operated ransomware lineage
• 2026-05-29 Earliest confirmed activity in the Symantec-analyzed incident: AnyDesk manually installed in a user's Music folder, providing persistent remote access to the attacker
• 2026-05-30 Attackers deploy locked-ioc-18 (masquerading as a Symantec product) which drops PoisonX (locked-ioc-25) kernel driver; 14-tool NirSoft credential harvesting suite and NetScan deployed on a second host
• 2026-06-01 PsExec used for lateral movement across the network; Windows Defender real-time monitoring disabled; administrative shares mounted with stolen credentials
• 2026-06-02 AnyDesk installed as two auto-start Windows services on 10+ hosts; attackers terminate AnyDesk and reboot each host; pre-staged PowerShell scripts handle automated setup on some machines
• 2026-06-03 GodDamn ransomware (locked-ioc-5) detected on a separate network segment; files encrypted with victim organization's name as extension; ransom note (locked-ioc-22) left with qTox and email contact details
• 2026-07-16 QuoIntelligence Week 29 snapshot and Symantec/Broadcom protection bulletin publicly disclose the GodDamn campaign and PoisonX signed driver technique

Sources cited for GodDamn PoisonX signed driver

• Symantec/Broadcom: GodDamn Ransomware — Latest Beast Rebrand Uses Malicious Driver to Disable Defenses broadcom.com · Research · 2026-07-16
• Team Cymru: Beast Ransomware Server Toolkit Analysis team-cymru.com · Research · 2026-03-11
• ASEC AhnLab: Beast Ransomware Analysis asec.ahnlab.com · Research · 2025-08-01
• SOCRadar: Dark Web Profile — Beast Ransomware socradar.io · Research · 2025-09-01
• Malpedia (Fraunhofer FKIE): win.beast malpedia.caad.fkie.fraunhofer.de · Research · 2026-05-04
• Mallory.ai: Hyadina Actor Profile mallory.ai · Research · 2026-07-01
• Cyberint: The Nature of the Beast Ransomware cyberint.com · Research · 2025-10-01
• Security.com: GodDamn Ransomware — Beast Rebrand Threat Intelligence security.com · Research · 2026-07-16
• CYBERCRIME.works: Beast Group Profile cybercrime.works · Research · 2025-12-01
• The Hacker News: GodDamn Ransomware Uses PoisonX Driver to Blind Security Software The Hacker News · News · 2026-07-16
• Security Affairs: GodDamn Ransomware Uses PoisonX to Blind Security Software securityaffairs.com · News · 2026-07-16
• BleepingComputer: Gentlemen Ransomware Uses Multiple EDR Killers BleepingComputer · News · 2026-06-01
• The Hacker News: The Gentlemen RaaS Uses GentleKiller EDR Framework The Hacker News · News · 2026-06-15
• QuoIntelligence: Threat Intelligence Snapshot — Week 29 of 2026 quointelligence.eu · Report · 2026-07-16

More in ransomware

• WhiteArmor ransomware/extortion group claims Hisense data theft (19 GB) and demands $5 million in Bitcoin
• DragonForce Ransomware Claims Victim lyserp.com (ERP Software Provider)
• Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated
• Vexy Ransomware claims System Soft (Bulgaria) - 65 GB exfiltrated
• Aur0ra Ransomware Operations Use Cursor and Claude AI to Automate Attacks (GOLD OGRE)

Related coverage of this activity

• GodDamn Beast rebrand