Green Light, Red Network: How GodDamn Ransomware's PoisonX Driver Turns Enterprise Security Dashboards Into Liabilities

Executive Summary

On July 9, 2026, researchers from Symantec's Threat Hunter Team published analysis of GodDamn, a ransomware variant deployed by the Hyadina threat group in active campaigns targeting North American enterprises — with documented concentration in the healthcare, manufacturing, and education sectors — since at least May 21, 2026. GodDamn is a functional rebrand of the Beast and Monster ransomware lineages, distinguished from its predecessors by its integration of PoisonX, a kernel-level driver carrying a legitimate Microsoft Windows Hardware Compatibility Publisher signature.

Operating at Ring 0 — the highest privilege tier of the Windows architecture — PoisonX issues IOCTL commands that terminate endpoint security processes and strip user-mode API hooks from the host operating system. The practical consequence is that local endpoint detection and response agents stop generating alerts and telemetry while remaining visually active on central management dashboards. Security operations teams see green. The host is being prepared for encryption.

Because PoisonX acquired its Microsoft signature through an administrative code-signing channel rather than a disclosed vulnerability, updates to Microsoft's Vulnerable Driver Blocklist are not yet universally available or enforced. Immediate actionable guidance: Deploy Windows Defender Application Control policies restricting unknown driver execution and shift monitoring strategy to include out-of-band network telemetry that does not depend on local endpoint agent reporting.

What Happened

GodDamn ransomware was first documented by CYFIRMA Research and Advisory on June 19, 2026, in a weekly intelligence report that identified underground forum activity and early victim telemetry, including the distinctive .God8Damn file extension applied to encrypted files. Symantec's Threat Hunter Team published the definitive technical analysis on July 9, 2026, tracing GodDamn's lineage to the Beast ransomware family — itself a predecessor to the Monster variant — and documenting the campaign's operational mechanics in detail. The threat group designated Hyadina is assessed as the primary operator.

Initial access in documented intrusions has been established through Remote Monitoring and Management utility abuse, specifically AnyDesk. The AnyDesk binary is placed not in standard system directories but in user-owned multimedia folders such as Music or Downloads — a deliberate placement that exploits weaker execution controls on user-writable paths and complicates standard file integrity monitoring. Once persistent remote access is established, the operators deploy a credential harvesting toolkit containing 14 distinct utilities drawn predominantly from the NirSoft software suite, a publicly available collection of diagnostic and administrative tools that individually carry legitimate reputations. Deployed collectively and automatically, these utilities extract credentials from browsers, email clients, and Windows memory spaces including LSASS, providing the operator with a broad credential set for lateral movement.

With credentials established, the operators introduce an executable named symantec.exe — a file designed to invoke trust through its filename while carrying no legitimate relationship to the Symantec security vendor. This executable delivers PoisonX to the host. PoisonX is an open-source kernel driver published to GitHub in April 2026 by a user identified as "oxfemale," accompanied by a legitimate Microsoft Windows Hardware Compatibility Publisher code signature — the same certificate class used by hardware vendors to certify that drivers are safe for Windows kernel loading. This signature was not obtained through a vulnerability in Microsoft's signing infrastructure; it was acquired through the administrative channel available to registered hardware compatibility partners, a class of signature that Windows trusts implicitly.

Once loaded into the kernel, PoisonX operates at Ring 0 — the Windows privilege tier reserved for the operating system kernel itself, above all user-mode processes including security software. From this position, PoisonX issues Input/Output Control (IOCTL) commands to locate and terminate security process handles, including endpoint detection and response agents, and to remove the user-mode API hooks those agents have installed to monitor process behavior, network connections, and file system activity. The termination of security processes and removal of their monitoring hooks produces a specific and operationally dangerous condition: the central security management console continues to show endpoint agents as active and reporting, because its last known state has not been updated. The host generates no further telemetry. The dashboard reads green.

With endpoint visibility neutralized, Hyadina operators proceed to data exfiltration followed by volume encryption. To defeat automated gateway scanning during the exfiltration phase, loaders used in the campaign employ file inflation — padding executables with hundreds of megabytes of null bytes to exceed the maximum file size processed by automated sandbox environments, bypassing gateway inspection controls. Lateral movement across network segments is facilitated by PsExec, enabling rapid simultaneous neutralization and encryption of multiple hosts using the harvested credential set.

The Bring Your Own Vulnerable Driver (BYOVD) technique has been documented across multiple ransomware and espionage campaigns. GodDamn's use of PoisonX represents a specific variant: not a legacy vulnerable driver being exploited for unintended privilege escalation, but a driver purpose-built for security process termination that acquired its signature through the legitimate hardware compatibility certification path. This distinction matters for defense: blocklist-based protection depends on prior knowledge of the specific driver hash, and that knowledge takes time to propagate after initial discovery.

Why It Matters

For Security Practitioners & Incident Response Teams

GodDamn's PoisonX integration breaks the foundational assumption underlying local endpoint telemetry: that a running EDR agent is a monitoring agent. When PoisonX removes user-mode API hooks at the kernel level, the security agent's process may remain alive in the process table while producing no meaningful behavioral data. It cannot alert on the credential harvesting that has already occurred. It cannot log the lateral movement currently in progress. It cannot report the file encryption beginning on the local volume. Incident responders arriving at a host that has been through this sequence will find endpoint logs that stop at or before the PoisonX deployment, with no record of subsequent activity. The investigative consequence is a forced pivot to network-layer forensics — NDR telemetry, DNS query logs, Active Directory authentication logs, and firewall session data become the primary evidentiary record.

For Security Leaders & CISOs

The specific operational consequence of PoisonX for executive-level security governance warrants direct statement: the enterprise security dashboard showing endpoint health across the organization may not reflect the actual security state of those endpoints. This is not a failure of the dashboard product itself — it reflects a designed capability by the threat operator to suppress the signal that dashboard depends on. Security leaders whose incident response and compliance reporting depend on dashboard integrity should treat this campaign as a prompt to validate whether out-of-band monitoring exists that does not depend on endpoint agent reporting as its primary data source. The Hyadina campaign's targeting of healthcare, manufacturing, and education sectors reflects threat actor awareness of the specific resilience constraints in those verticals: critical operational processes, limited security staffing relative to network size, and in some cases regulatory constraints that complicate aggressive endpoint lockdown postures.

For Policy, Risk & Compliance Officers

PoisonX's acquisition of a legitimate Microsoft signature through the hardware compatibility certification channel represents an exploitation of the software supply chain's trust architecture rather than a conventional software vulnerability. Standard driver verification correctly validates PoisonX as signed by a trusted authority, because it is. The security gap is not in the verification mechanism; it is in the time between a malicious driver's discovery and its addition to, and enforcement of, the Microsoft Vulnerable Driver Blocklist. That gap is measured in weeks during active campaigns. Compliance frameworks that treat "signed by a trusted publisher" as equivalent to "confirmed safe" should be reviewed in light of this demonstrated exploitation pattern. Proactive driver allowlisting — specifying which drivers are permitted rather than which are blocked — provides a structurally more robust control posture than blocklist-dependent verification for this threat class.

Operational Implications

Immediate (Days to Weeks): Organizations in the healthcare, manufacturing, and education sectors — and any enterprise with AnyDesk or equivalent RMM tools deployed — should treat the GodDamn campaign as an active and current threat. Immediate actions include: auditing RMM tool installations across the enterprise to identify AnyDesk binaries located outside standard system directories, particularly in user-writable paths including Downloads, Music, Temp, and AppData; reviewing Windows Defender Application Control or equivalent driver allowlisting policies to confirm whether unknown kernel drivers are blocked from loading; and verifying that the Microsoft Vulnerable Driver Blocklist is current and enforcement-enabled, recognizing this control alone is insufficient but represents the minimum baseline.

Security operations teams should evaluate whether current SIEM and detection coverage includes network-layer telemetry sources — NDR, DNS query logs, Active Directory authentication logs — that provide investigative data independently of endpoint agent reporting. Where this coverage is incomplete, it should be treated as a detection gap with direct relevance to the GodDamn threat model.

Short-Term (Weeks to Months): Incident response playbooks should be updated to account for the scenario in which endpoint telemetry is unavailable or unreliable from a specific point in time forward on a compromised host. The specific indicator is notable: a host whose EDR agent reports as active but produces no behavioral telemetry for an extended period during active business hours should be treated as a potential PoisonX deployment candidate — not a healthy quiet endpoint. Threat hunting queries targeting GodDamn-related indicators should be deployed against historical data extending back to May 21, 2026: AnyDesk execution from user multimedia directories, NirSoft utility execution (particularly simultaneous deployment of multiple utilities), symantec.exe execution from non-Symantec installation paths, and PoisonX driver hash indicators from the Symantec bulletin of July 9, 2026.

Long-Term (Months to Years): The BYOVD technique class has been documented across multiple unrelated threat groups and is not specific to the Hyadina campaign. ESET Research's analysis of standardized defense evasion across ransomware affiliate networks documents the industrialization of this capability. Organizations planning long-term security architecture evolution should treat driver allowlisting via WDAC not as a response to a specific campaign but as a structural control requirement. Backup architecture should specifically account for the scenario in which endpoint agents and security monitoring are offline simultaneously — immutable, network-isolated backup infrastructure that cannot be reached through harvested enterprise credentials provides the recovery foundation that survives a GodDamn-class attack.

Recommended Actions

Actions are organized by organizational security maturity. Begin at your current tier and work upward. The blocklist verification and RMM audit steps are minimum baselines for all environments regardless of maturity level.

Closing Statement

GodDamn ransomware does not exploit a novel vulnerability in Windows or in endpoint security products. It exploits the trust architecture that enterprise security depends on: the assumption that a signed driver is a safe driver, and that an agent reporting as active is an agent that is monitoring. When a threat operator can invalidate both of those assumptions simultaneously — using a legitimately signed tool to achieve kernel-level privilege and use that privilege to silence the security layer — the entire visibility model that security operations depends on requires reassessment.

Cultivating institutional resilience against this trajectory requires visibility architectures that do not share a trust boundary with what they are monitoring. Bridging the awareness gap here means recognizing that the adversarial investment is moving upward in the privilege stack, toward the layers of the operating system where security tooling has historically been absent.