[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTAyFi4YlmZ7h8y_BjDLjCCfOs7OXBr251J4HypVkLZw":3},{"article":4,"iocs":55,"watch_terms":85,"solutions":86,"lesson":169},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"e3e291b9-101e-440b-8601-9a9e5a8de2f6","GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses","goddamn-ransomware-uses-poisonx-driver-to-disable-endpoint-defenses-d49881","Cybersecurity researchers have flagged a new ransomware family called GodDamn that employs the PoisonX kernel driver to neutralize security software as part of its defense evasion strategy. According to a new report published by the Threat Hunter Team from Symantec, the ransomware was first publicly spotted in the wild on May 21, 2026. It's assessed to be a rebrand of the Beast ransomware,","A new ransomware family named GodDamn has been observed using the PoisonX kernel driver, which is reportedly signed by Microsoft, to disable endpoint security software. This technique, known as Bring Your Own Vulnerable Driver (BYOVD), allows attackers to bypass defenses. The ransomware is believed to be a rebrand of Beast ransomware, developed by an entity tracked as Hyadina.","GodDamn ransomware uses a Microsoft-signed PoisonX driver to disable endpoint defenses.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fgoddamn-ransomware-uses-poisonx-driver.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEge_nKJNwSt3ZRkzfZ2qH61_1WFg5hyphenhyphenMSrC3-JM4AOXRKO-IVsJXFNiM926QnG25eTply3DRF57t61wi5Ucy4yxald1RpH1TRbItw83RqQ-K6UM670vpR76-kBl2xcntaDE7lxxNwurseG5iRM4sMhYK8Npb9COGNM_XjbwBLthnJjBfwqV7m96VKOnWb3Q\u002Fs1600\u002Fendpoint-ransomware.jpg","2026-07-09T10:43:09+00:00","2026-07-09T12:00:25.086466+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Hyadina","threat_actor",{"name":21,"type":22},"Symantec","vendor",{"name":24,"type":22},"Microsoft",{"name":26,"type":27},"AnyDesk","product",{"name":29,"type":27},"NirSoft",{"name":31,"type":27},"PsExec","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59,62,65,69,73,76,79,82],{"type":36,"value":57,"context":58},"GodDamn","New ransomware family",{"type":36,"value":60,"context":61},"Beast","Previous ransomware family, likely rebrand of GodDamn",{"type":36,"value":63,"context":64},"Monster","Earlier ransomware family, predecessor to Beast",{"type":66,"value":67,"context":68},"domain","g11.sys","PoisonX kernel driver file name",{"type":70,"value":71,"context":72},"mitre_attack","T1070.004","Indicator Removal: File Deletion (related to BYOVD)",{"type":70,"value":74,"context":75},"T1562.001","Impair Defenses: Disable or Modify Tools (related to BYOVD)",{"type":70,"value":77,"context":78},"T1071","Application Layer Protocol (related to AnyDesk usage)",{"type":70,"value":80,"context":81},"T1003","OS Credential Dumping (related to credential harvesting toolkit)",{"type":70,"value":83,"context":84},"T1570","Lateral Tool Transfer (related to PsExec)",[24,21,26],{"controls":87,"vendors":165},[88,116,136],{"slug":89,"name":90,"problem":91,"products":92},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[93,101,108],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":89,"product_name":105,"url":106,"description":107},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":117,"name":118,"problem":119,"products":120},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[121,129],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":130,"vendor_name":24,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":137,"name":138,"problem":139,"products":140},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[141,149,157],{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[166],{"slug":130,"name":24,"logo_path":131,"roles":167},[168],"affected",{"slug":170,"title":171,"body":172,"framework_refs":173,"framework_notes":185},"goddamn-ransomware-exploits-signed-driver-to-kill-endpoint-defenses","GodDamn Ransomware Exploits Signed Driver to Kill Endpoint Defenses","The GodDamn ransomware leverages a Bring Your Own Vulnerable Driver (BYOVD) attack, abusing a Microsoft-signed kernel driver called PoisonX to disable endpoint detection and response (EDR) tools before deploying ransomware. Because the driver carries a legitimate Microsoft signature, traditional allowlisting controls may fail to block it at the kernel level. This technique is especially dangerous because it operates with ring-0 privileges, effectively blinding security tools before an attacker moves to encryption or lateral movement. The ransomware's rebrand from Beast also highlights how threat actors recycle and evolve tooling to evade signature-based detection, making behavioral and driver-level controls critical.",[174,175,176,177,178,179,180,181,182,183,184],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-83: Guide to Malware Incident Prevention and Handling","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1014: Rootkit (BYOVD technique)","Microsoft HVCI \u002F Memory Integrity Driver Blocklist Policy",{}]