Symantec Threat Hunter Team Uncovers Hyadina’s Use of Microsoft Signed Driver in GodDamn Ransomware Attack

Key Takeaways

• Symantec Threat Hunter Team linked GodDamn ransomware to the Beast and Monster families operated by Hyadina
• The attackers used a malicious Microsoft-signed PoisonX driver to disable defenses at the kernel level
• The intrusion combined AnyDesk-based access, NirSoft credential theft, PsExec lateral movement, and a dwell period before encryption

The recent analysis released on July 9, 2026, by the Symantec Threat Hunter Team details how the Hyadina ransomware-as-a-service group continues to evolve its operations. Their investigation of a GodDamn ransomware incident demonstrates how established malware families shift techniques, tooling, and branding to bypass mature security programs.

GodDamn is not a fresh strain; it is the latest rebrand of Beast ransomware and, before that, Monster ransomware, first seen in 2022. The underlying code overlaps significantly, allowing researchers to tie the activity back to Hyadina. The primary evolution lies in how the operators approached defense evasion. The appearance of the PoisonX kernel driver, signed by Microsoft as a legitimate Windows Hardware Compatibility Publisher artifact, directly targets and neutralizes EDR and AV controls.

According to the Symantec team, GodDamn was first observed on May 21, 2026, and the attack they studied occurred in early June. On May 29, AnyDesk was manually dropped into the Music folder of a user profile on one host before contacting relay servers. Remote access tools with unattended access modes have become a recurring part of ransomware intrusions, a vector noted repeatedly in annual threat summaries from groups like ENISA and advisory bodies such as the UK NCSC.

On May 30, the attackers deployed the symantec.exe user-mode evasion tool and installed the PoisonX driver. That driver, once loaded, killed EDR or antivirus processes and removed user-mode hooks. It had previously been documented in early 2026 terminating the CrowdStrike Falcon service. PoisonX looks legitimate to Windows due to its authentic Microsoft signature, appearing as a malicious driver that successfully cleared signing requirements rather than a standard bring-your-own-vulnerable-driver (BYOVD) execution. This incident highlights that driver signing enforcement cannot be viewed as a standalone safeguard.

Reports such as the 2024 analysis by Gartner have found that 80% of successful ransomware incidents involve disabling endpoint defenses. Regulatory bodies such as CISA have emphasized kernel tampering and BYOVD methods in their #StopRansomware guidance, recommending stronger access controls, application policies, and monitoring of driver load events.

The attackers also staged an extensive NirSoft-based credential harvesting toolkit on a second host. 14 separate tools were included, targeting browsers, cached domain credentials, Wi-Fi profiles, and VNC sessions. Netscan was added to map reachable systems. A two-day gap followed, aligning with trends documented in European threat landscape work by ENISA, which describes an increasing reliance on multi-stage intrusion techniques that separate initial access from lateral movement.

June 1 brought lateral movement. PsExec was the operator’s tool of choice, with malicious commands traced back through psexesvc.exe. After gathering network context, the attackers disabled Windows Defender real-time monitoring and used stolen credentials to mount administrative shares. They then installed AnyDesk on numerous hosts using both scripted and manual deployment sequences. The configuration forced unattended access by setting ad.security.interactive_access to 2 and writing service entries to ensure persistence. On some machines, a pre-staged PowerShell installer handled the entire process.

Access passwords were updated during subsequent deployments, indicating that the operators actively refined their scripts. After installing AnyDesk, they killed the active AnyDesk process, waited a few seconds, and rebooted the machine. By June 2, at least 10 hosts had been prepared for remote access and monitoring.

Ransomware encryption began on June 3 in a separate network segment, where an encrypter binary started appearing in Downloads and Music folders. While some GodDamn attacks have used the .God8Damn extension, these attackers renamed files using the victim organization’s name. This hands-on-keyboard personalization fits the manual execution patterns observed throughout the intrusion.

These events demonstrate that ransomware groups continue to mix traditional IT tools like PsExec with kernel-level tampering and legitimate remote access utilities. Frameworks such as NIST assist in structuring identification, protection, detection, response, and recovery controls, while the MITRE ATT&CK knowledge base maps specific adversary behaviors like driver-based defense evasion.

The Symantec investigation illustrates how groups like Hyadina assemble these multi-stage techniques, underscoring the need for layered defenses that account for legitimate tool abuse, strict application whitelisting, and kernel-level threat detection to shorten response times.