GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

What Happened

A criminal group called Hyadina has released a new type of ransomware called GodDamn, which is actually a renamed version of their earlier Beast and Monster ransomware. What makes this particularly dangerous is that they use a malicious software component (a kernel driver called PoisonX) that carries a legitimate Microsoft digital signature, allowing it to disable antivirus and security software at the deepest level of the operating system. The attackers break into networks, install remote access software (AnyDesk) configured to work without the computer user's knowledge, steal passwords using a collection of 14 different password-recovery tools, and then spread across the organization's computers before locking files. Organizations running Windows systems are the primary targets. Security teams should immediately check for the specific files, network connections, and behaviors described in this report, and should verify whether their endpoint protection can detect the PoisonX driver and the tools used in this attack.

Key Takeaways

• GodDamn ransomware is the latest rebrand of Beast/Monster ransomware, developed by threat actor Hyadina, first seen May 21, 2026.
• Attackers used the PoisonX kernel driver — a malicious driver signed by Microsoft — to terminate security product processes and remove user-mode API hooks, representing a significant escalation in defense evasion.
• A comprehensive NirSoft-based credential harvesting toolkit comprising 14 tools was deployed alongside Mimikatz to steal credentials from browsers, email clients, Wi-Fi profiles, VNC sessions, and Windows Credential Manager.
• AnyDesk was configured for unattended remote access by suppressing interactive consent prompts (ad.security.interactive_access=2) and registered as dual auto-start Windows services for persistence.
• Lateral movement was performed via PsExec across at least 10 hosts, with a four-day dwell period between initial access and ransomware deployment.

Affected Systems

• Windows operating systems (32-bit and 64-bit)
• Linux (Beast variant)
• VMware ESXi (Beast variant)

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Unknown vector; earliest activity is AnyDesk binary placed in non-standard Music folder on May 29, 2026, suggesting prior access obtained
2. Defense Evasion: symantec.exe tool drops PoisonX signed kernel driver (g11.sys) to terminate security products and remove API hooks; Windows Defender real-time monitoring disabled via PowerShell
3. Credential Harvesting: 14-tool NirSoft-based toolkit deployed alongside Mimikatz to recover credentials from browsers, email clients, Wi-Fi, VNC, and Windows Credential Manager
4. Lateral Movement: PsExec used to push commands to remote hosts; administrative shares mounted with stolen credentials; AnyDesk installed on each host with unattended access config and dual service persistence
5. Dwell Period: Approximately 4-day gap between initial access and ransomware deployment, likely used for staging, exfiltration, and reconnaissance
6. Impact: GodDamn ransomware (encrypter-windows-gui-x86.exe) deployed from user profile directories, encrypting files with .God8Damn or victim organization name as extension

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Symantec Protection Bulletin

The article references the Symantec Protection Bulletin for protection updates but does not include any YARA, Sigma, Snort/Suricata, KQL, SPL, or EQL rules in the blog post itself.

Detection Engineering Assessment

Required Log Sources

• Windows Security Event Logs (4624, 4688, 7045)
• Sysmon (Process Creation, File Creation, Driver Loading)
• EDR process telemetry
• Network firewall/IDS logs
• DNS resolution logs
• Windows System Event Logs (Service creation)

Hunting Hypotheses

Control Gaps

• Application allowlisting would not catch legitimate tools like AnyDesk, NirSoft utilities, or PsExec being abused by attackers
• Driver signature validation would not block PoisonX since it carries a valid Microsoft signature
• Traditional signature-based AV would miss the defense evasion tool disguised as a Symantec product
• EDR agents may be blinded once PoisonX terminates security processes and removes API hooks
• Network segmentation alone would not prevent PsExec-based lateral movement if credentials are valid

Key Behavioral Indicators

• AnyDesk binary executing from user Music folder or D: drive rather than Program Files
• Process lineage of psexesvc.exe -> services.exe -> wininit.exe indicating PsExec-based remote execution
• Creation of dual AnyDesk Windows services (AnyDeskService and AnyDesk_D) pointing to D: drive binary
• AnyDesk configuration file containing ad.security.interactive_access=2 in non-standard directory
• Multiple NirSoft password recovery tools executing from a single staging directory (csidl_profile\music\mimik\pass)
• New kernel driver g11.sys appearing in system driver store with no prior installation history
• PowerShell Set-MpPreference -DisableRealtimeMonitoring execution following PsExec session
• Ransomware binary encrypter-windows-gui-x86.exe appearing in user Downloads or Music folders
• Files being renamed with victim organization name as file extension

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether restricting PsExec execution via application control or Group Policy would be feasible for your environment, as it was the primary lateral movement vector.
• Consider implementing network segmentation to limit SMB traffic between workstations, which would impede PsExec-based lateral movement and admin share mounting.
• If supported by your endpoint platform, consider enabling driver block rules or vulnerable driver blocklists to prevent loading of non-standard kernel drivers.
• Evaluate whether Windows Defender Tamper Protection is enabled across endpoints, which may prevent disabling of real-time monitoring via PowerShell.
• Consider monitoring for and alerting on the creation of new Windows services, particularly those with auto-start type pointing to non-standard binary paths.

User Protection

• Consider deploying application allowlisting for remote access tools, restricting AnyDesk execution to approved installation paths only.
• If your EDR supports host isolation, consider preparing playbooks for rapid isolation of hosts showing signs of PoisonX driver deployment or credential toolkit staging.
• Evaluate whether credential guard or LSA protection features are enabled on Windows endpoints to mitigate credential dumping via Mimikatz.
• Consider auditing browser credential stores and enforcing browser-based password managers with master passwords to reduce exposure to NirSoft credential recovery tools.

Security Awareness

• Consider incorporating awareness of legitimate remote access tool abuse (AnyDesk, PsExec) into existing security training programs for IT staff.
• If applicable to your organization, consider reminding employees to report any unexpected software installations or system slowdowns, as the ransomware deployment follows a multi-day dwell period.
• Consider educating IT administrators on the risks of storing remote access tools in non-standard directories and the importance of verifying service creation events.

MITRE ATT&CK Mapping

Additional IOCs

• File Hashes:
  • 45126297c07c6ef56b51440cd0dc30acf7b3b938e2e9e656334886fe2f81f220 (SHA256) - AnyDesk binary (anydesk.exe) placed in non-standard Music folder for remote access
  • 141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944 (SHA256) - PsExec (psexesvc.exe) used for lateral movement across enterprise hosts
  • 31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc (SHA256) - Mimikatz (mimik.exe) credential dumping tool staged in credential harvesting toolkit
  • 9fae3f15900e13ec3860a109555ecd33ca43d38907c63438c50a2d6d91bfee1d (SHA256) - Netscan (netscan.exe) network mapping tool placed in staging directory
  • 8ff1c1967841a595d996a649c8134b7a5970dcf94624b237d1b089e7c6266167 (SHA256) - WebBrowserPassView (webbrowserpassview.exe) — browser credential recovery tool
  • 5c4c98d774eb100f9a89ae4e984c27a4f532e58c7cf8c87046dc87db5a065404 (SHA256) - ChromePass (chromepass.exe) — Chrome browser password recovery tool
  • faca9e856c369b63d6698c74b1d59b062a9a8d9fe84b8f753c299c9961026395 (SHA256) - PasswordFox (passwordfox64.exe) — Firefox browser password recovery tool
  • 7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26 (SHA256) - MessengerPass (mspass.exe) — messenger password recovery tool
  • 816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019 (SHA256) - VNCPassView (vncpassview.exe) — VNC session password recovery tool
  • 5be325905df8aab7089ab2348d89343f55a2f88dadd75de8f382e8fa026451bd (SHA256) - MailPassView (mailpv.exe) — email client password recovery tool
  • c92580318be4effdb37aa67145748826f6a9e285bc2426410dc280e61e3c7620 (SHA256) - SniffPass (sniffpass64.exe) — live network traffic password capture tool
  • 8e4b218bdbd8e098fff749fe5e5bbf00275d21f398b34216a573224e192094b8 (SHA256) - OperaPassView (operapassview.exe) — Opera browser password recovery tool
  • 35296e7a34688ca3e3159bcdf92b4d60ba4173a2369aca531bb7bc959f68ed9c (SHA256) - CredentialsFileView (credentialsfileview64.exe) — Windows Credential Manager viewer
  • 19bab15a34d5ad838ccf4d187eb40379c335fa56446d0f9621865b2767d4ac7d (SHA256) - WirelessKeyView (wirelesskeyview64.exe) — Wi-Fi profile password recovery tool
  • ece33e4b7e2d26eeca8ad9db4439f9801a7a77e332611116156738b1b0316046 (SHA256) - ExtPassword (extpassword.exe) — external password recovery tool
  • 5e85446910e732111ca9ac90f9ed8b1dee13c3314d2c5117dcf672994ce73bd6 (SHA256) - PSTPassword (pstpassword.exe) — PST file password recovery tool
  • 17fb52476016677db5a93505c4a1c356984bc1f6a4456870f920ac90a7846180 (SHA256) - Netpass (netpass64.exe) — network password recovery tool
• File Paths:
  • csidl_profile\music\anydesk.exe - AnyDesk binary placed in non-standard Music folder — consistent with manual attacker delivery
  • csidl_profile\music\symantec.exe - Defense evasion tool impersonating Symantec product, staged in user Music folder
  • csidl_system\drivers\g11.sys - PoisonX kernel driver dropped into system driver store by symantec.exe
  • csidl_profile\music\mimik\pass\ - Credential harvesting toolkit staging directory containing 14 password recovery tools
  • csidl_profile\downloads\encrypter-windows-gui-x86.exe - GodDamn ransomware binary deployed from Downloads folder
  • csidl_profile\music\encrypter-windows-gui-x86.exe - GodDamn ransomware binary deployed from Music folder
  • CSIDL_DRIVE_FIXED\ad_data\system.conf - AnyDesk configuration file with interactive_access=2 to suppress consent prompts
  • CSIDL_SYSTEM_DRIVE\apps\install_ad.ps1 - Pre-staged PowerShell script for automated AnyDesk rollout across hosts
• Command Lines:
  • Purpose: Disable Windows Defender real-time monitoring | Tools: powershell.exe | Stage: Defense Evasion | powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  • Purpose: Mount remote administrative share using stolen credentials for lateral movement | Tools: net.exe | Stage: Lateral Movement | net use \\<host>\c$ /user:
  • Purpose: Create AnyDesk configuration directory and set unattended access config | Tools: powershell.exe, anydesk.exe | Stage: Persistence | powershell -Command "New-Item -ItemType Directory -Force -Path
  • Purpose: Register AnyDesk as auto-start Windows services for persistence across reboots | Tools: sc.exe | Stage: Persistence | sc create <servicename> binPath=
  • Purpose: Execute pre-staged AnyDesk installer PowerShell script | Tools: powershell.exe | Stage: Persistence | powershell.exe -ExecutionPolicy Bypass -File
  • Purpose: Install AnyDesk to standard Program Files with start-with-Windows persistence | Tools: anydesk.exe | Stage: Persistence | anydesk.exe --install
  • Purpose: Terminate AnyDesk process and reboot host after deployment | Tools: taskkill.exe, shutdown.exe | Stage: Post-deployment | taskkill /f /im anydesk.exe
  • Purpose: Launch defense evasion tool from D: drive | Tools: cmd.exe | Stage: Defense Evasion | cmd /c "start /b
• Other:
  • .God8Damn - File extension appended to encrypted files in some GodDamn ransomware attacks
  • ad.security.interactive_access=2 - AnyDesk configuration parameter that suppresses interactive consent prompt, allowing unattended remote access without local user approval