# Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses PoisonX Signed Kernel Driver to Disable Endpoint Defenses

> The Russian-speaking RaaS operator Hyadina has rebranded its Beast ransomware as 'GodDamn', first spotted in the wild on May 21, 2026. In a June 2026 incident, operators deployed a malicious Microsoft-signed kernel driver (PoisonX/g11.sys) to terminate endpoint security processes and strip kernel-mode protections before deploying the GodDamn encryptor. The attack chain involved AnyDesk remote access, a 14-tool NirSoft credential-harvesting suite, PsExec lateral movement to 10+ hosts, and AES-256-CBC+RSA-2048 file encryption with a .God8Damn extension. The PoisonX driver was also adopted by the Gentlemen RaaS operation in its GentleKiller EDR-killing framework.

- **Published:** 2026-09-08T00:00:00Z
- **Last reviewed:** 2026-09-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2409
- **ID:** TL-2026-2409
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Hyadina (Russia)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GodDamn is the third iteration of a ransomware lineage operated by the financially motivated Russia-based actor Hyadina, evolving from Monster (Delphi-based RaaS, March 2022) through Beast (cross-platform RaaS with Linux/VMware ESXi support, June 2024) to GodDamn (first observed May 21, 2026). The malware represents a significant escalation in defensive evasion capability through the use of PoisonX, a malicious kernel driver that its developers successfully obtained a valid Microsoft Windows Hardware Compatibility Publisher signature for, enabling it to bypass Windows code-signing trust and auto-load as a kernel driver.

In a detailed incident analyzed by Symantec's Threat Hunter Team from early June 2026, the attack chain began with an unknown initial access vector. By May 29, anyDesk had been manually installed in a non-standard path under the user's Music folder, providing persistent remote access. On May 30, operators deployed a defense-evasion tool disguised as symantec.exe from the same Music folder, which dropped the PoisonX kernel driver (g11.sys) into the Windows driver store. A 14-tool NirSoft-based credential harvesting toolkit was simultaneously deployed, containing Mimikatz, WebBrowserPassView, ChromePass, PasswordFox, MessengerPass, VNCPassView, MailPassView, SniffPass, OperaPassView, CredentialsFileView, WirelessKeyView, ExtPassword, PSTPassword, and NetPass, alongside NetScan for network mapping.

On June 1, operators used PsExec to move laterally across the network, reaching at least 10 hosts. All commands were routed through the psexesvc.exe process chain. Windows Defender real-time monitoring was disabled, and administrative shares were mounted with stolen credentials. On each host, AnyDesk was installed as two auto-start Windows services with a suppressed interactive consent prompt and a pre-configured remote access password. By the end of June 2, this deployment had been completed across the victim environment. On June 3, the GodDamn ransomware binary (encrypter-windows-gui-x86.exe) was detected on a separate network segment belonging to a distinct organizational unit, where it began encrypting files with the victim organization's name as the file extension (rather than the .God8Damn extension used in other Hyadina attacks).

PoisonX (g11.sys) operates at kernel level, sending crafted IOCTL commands to terminate security product processes and remove user-mode API hooks, effectively blinding EDR tools while they appear to remain running. The driver was first documented in early 2026 being used to disable the CrowdStrike Falcon service. It was published to GitHub on April 7, 2026, by an author using the alias 'oxfemale', described as a research tool. The driver has also been adopted by the Gentlemen RaaS operation, which packages it as the G11 variant within its eight-driver GentleKiller EDR-killing framework, targeting 400+ processes from approximately 48 security vendors.

GodDamn uses a hybrid cryptosystem: per-file AES-256-CBC encryption with a unique random IV, with the symmetric key wrapped using RSA-2048 with PKCS#1 v1.5 padding. Encrypted files are renamed with the .God8Damn extension (or the victim's organization name) and a ransom note (README.TXT) instructs victims to contact the attackers via email (God8Damn@hotmail.com, god8damn@cyberfear.com) or the qTox encrypted messaging application. The Beast ransomware data leak site, operating on Tor (beast6azu4f7fxjaki[...].onion), supports double extortion by publishing stolen data from victims who do not pay.

Hyadina's RaaS operation has been active since 2022, initially marketing Monster on the Russian Anonymous Marketplace (RAMP). The Beast variant was first promoted on RAMP in June 2024, with an offline builder introduced in August 2024 supporting Windows, NAS, and VMware ESXi targets. The group avoids targeting systems in Commonwealth of Independent States (CIS) countries (Russia, Belarus, Kazakhstan, etc.) as well as several other nations, checking locale via GetLocaleInfo/GetSystemDefaultUILanguage. A Team Cymru analysis of an exposed Beast operator C2 server (5.78.84.144:8000, Hetzner AS212317) in March 2026 revealed the full toolkit including MEGAsync and WinSCP for data exfiltration, Volume Shadow Copy deletion scripts, and both Windows and Linux encryptors. The Beast data leak site, active since July 2025, has claimed over 100 victims across manufacturing, healthcare, education, government, and other sectors.

## MITRE ATT&CK

- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1543 Create or Modify System Process
- T1219 Remote Access Tools
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1614 System Location Discovery
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1046 Network Service Discovery
- T1021 Remote Services
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [Symantec/Broadcom: GodDamn Ransomware — Latest Beast Rebrand Uses Malicious Driver to Disable Defenses](https://www.broadcom.com/support/security-center/protection-bulletin/goddamn-ransomware-latest-beast-rebrand-uses-malicious-driver-to-disable-defenses)
- [The Hacker News: GodDamn Ransomware Uses PoisonX Driver to Blind Security Software](https://thehackernews.com/2026/07/goddamn-ransomware-uses-poisonx-driver.html)
- [Security Affairs: GodDamn Ransomware Uses PoisonX to Blind Security Software](https://securityaffairs.com/195042/malware/goddamn-ransomware-uses-poisonx-to-blind-security-software.html)
- [QuoIntelligence: Threat Intelligence Snapshot — Week 29 of 2026](https://quointelligence.eu/2026/07/threat-intelligence-snapshot-week-29-2026/)
- [Team Cymru: Beast Ransomware Server Toolkit Analysis](https://www.team-cymru.com/post/beast-ransomware-server-toolkit-analysis)
- [ASEC AhnLab: Beast Ransomware Analysis](https://asec.ahnlab.com/en/90792/)
- [SOCRadar: Dark Web Profile — Beast Ransomware](https://socradar.io/blog/dark-web-profile-beast-ransomware/)
- [Malpedia (Fraunhofer FKIE): win.beast](https://malpedia.caad.fkie.fraunhofer.de/details/win.beast)
- [BleepingComputer: Gentlemen Ransomware Uses Multiple EDR Killers](https://www.bleepingcomputer.com/news/security/gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses/)
- [The Hacker News: The Gentlemen RaaS Uses GentleKiller EDR Framework](https://thehackernews.com/2026/06/the-gentlemen-raas-uses-gentlekiller.html)
- [Mallory.ai: Hyadina Actor Profile](https://mallory.ai/actors/019f466b-a6e6-7787-a7a0-20e5ec6eef15)
- [Cyberint: The Nature of the Beast Ransomware](https://cyberint.com/blog/research/the-nature-of-the-beast-ransomware/)
- [Security.com: GodDamn Ransomware — Beast Rebrand Threat Intelligence](https://www.security.com/threat-intelligence/goddamn-ransomware-beast-rebrand)
- [CYBERCRIME.works: Beast Group Profile](https://cybercrime.works/groups/beast)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2409