There’s a new ransomware family in town, and it’s bringing a signed kernel driver to the fight. Researchers at Symantec’s Threat Hunter Team flagged GodDamn ransomware, first spotted in the wild on May 21, 2026. It’s not entirely new — it’s a rebrand of Beast ransomware, which was itself an upgraded version of Monster, a Delphi-based strain from March 2022.
Symantec tracks the developer behind all three as Hyadina. One family, three names, same playbook getting more dangerous each time.
Here’s what makes GodDamn stand out: it uses the PoisonX kernel driver (packaged as g11.sys) to disable endpoint defenses. This is a bring-your-own-vulnerable-driver (BYOVD) attack, but with a twist. PoisonX appears to be a malicious driver that its developers actually got signed by Microsoft. That signature means Windows loads it automatically. Your EDR doesn’t even get a vote.
In one attack from early June 2026, the threat actors used AnyDesk for remote access and deployed a NirSoft-based credential harvesting toolkit before dropping the ransomware. The toolkit grabbed credentials from browsers, Windows Credential Manager, cached domain logins, VNC sessions, email clients, Wi-Fi profiles, and live network traffic. Everything.
The attack chain worked like this: AnyDesk was placed in the user’s Music folder — not a standard install directory, suggesting manual delivery after initial access was already gained. Then came the defense evasion tool, disguised as symantec.exe, which dropped the PoisonX driver into the system driver store. Once loaded, it could terminate security product processes and remove user-mode API hooks.
From there, PsExec handled lateral movement. AnyDesk was set up on each reachable host and registered as an auto-start Windows service. On some machines, a PowerShell script handled the entire AnyDesk deployment — reusable installer, streamlined process.
The encrypted files get renamed with .God8Damn extension, or sometimes the victim organization’s name. Depends on the mood, apparently.
Broadcom’s analysts put it bluntly: “Vulnerable drivers are the attacker’s most reliable route in.” A signed malicious driver? That’s even worse. Microsoft signed it, Windows trusts it, and your security stack can’t tell the difference until it’s already too late.
