GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses
GodDamn ransomware uses a Microsoft-signed PoisonX driver to disable endpoint defenses.
A new ransomware family named GodDamn has been observed using the PoisonX kernel driver, which is reportedly signed by Microsoft, to disable endpoint security software. This technique, known as Bring Your Own Vulnerable Driver (BYOVD), allows attackers to bypass defenses. The ransomware is believed to be a rebrand of Beast ransomware, developed by an entity tracked as Hyadina.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe GodDamn ransomware leverages a Bring Your Own Vulnerable Driver (BYOVD) attack, abusing a Microsoft-signed kernel driver called PoisonX to disable endpoint detection and response (EDR) tools before deploying ransomware. Because the driver carries a legitimate Microsoft signature, traditional allowlisting controls may fail to block it at the kernel level. This technique is especially dangerous because it operates with ring-0 privileges, effectively blinding security tools before an attacker moves to encryption or lateral movement. The ransomware's rebrand from Beast also highlights how threat actors recycle and evolve tooling to evade signature-based detection, making behavioral and driver-level controls critical.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GodDamn
- malware — Beast
- malware — Monster
- domain — g11.sys
- mitre_attack — T1070.004
- mitre_attack — T1562.001
- mitre_attack — T1071
- mitre_attack — T1003
- mitre_attack — T1570