GodDamn Ransomware

GodDamn is a ransomware variant (a rebrand of the Beast/Monster lineage tracked internally as "Hyadina") flagged by Symantec for using the PoisonX kernel driver to disable endpoint defenses before deploying ransomware.

Technical Details

• Defense evasion: Uses PoisonX kernel driver to disable or bypass endpoint detection and response (EDR) tools
• Remote access: Uses AnyDesk for hands-on-keyboard remote access
• Credential harvesting: Uses NirSoft tools for credential theft
• Lineage: Rebrand of Beast/Monster lineage (tracked as "Hyadina" by Symantec) (raw/digests/Cyber-Digest-2026-07-10.md)

Infection Chain

1. Initial access (likely via RDP or phishing)
2. PoisonX driver deployed → EDR/AV disabled
3. Credential harvesting via NirSoft tools
4. AnyDesk installed for persistent remote access
5. Ransomware deployed via hands-on-keyboard

Related Pages

• Gigawiper — Destructive malware with different objectives
• Redwing Maas — Malware-as-a-Service model comparison
• Scattered Spider — Ransomware-focused threat group