Symantec’s Threat Hunter Team detailed GodDamn ransomware deploying PoisonX, a kernel driver that carries a genuine Microsoft Windows Hardware Compatibility Publisher signature, to switch off endpoint defenses before encrypting. The driver, shipped as g11.sys, terminates security processes, tampers with kernel callbacks, and strips protections from protected processes. GodDamn is the newest branch of the Hyadina lineage, which ran as Monster in 2022 and Beast in 2024. Operators used AnyDesk, PsExec, and credential tools before encryption. The story is the abuse of a valid signature, not a stolen one.
What is bring-your-own-vulnerable-driver?
Bring-your-own-vulnerable-driver, or BYOVD, is a technique where attackers load a legitimately signed but abusable kernel driver to gain the highest level of access on Windows. Because the driver is signed, Windows trusts it, and from kernel space the attacker can do what user-mode security tools cannot stop, including killing those tools. It has become a standard pre-encryption step for serious ransomware crews. For the wider EDR-evasion trend, see our reporting on how The Gentlemen weaponized a signed driver to kill EDR.
What makes PoisonX notable?
PoisonX is not exploiting a stolen certificate or a forged signature. It carries a valid Microsoft Windows Hardware Compatibility Publisher signature, meaning it passed, at some point, the trust process Windows uses to vet kernel code. Loaded as g11.sys, it terminates processes, tampers with security callbacks, and removes protections from processes that are supposed to be shielded. That combination lets GodDamn operators disable endpoint detection at the kernel level, then encrypt with the defenders effectively deaf and blind.
How the full attack unfolds
Before the driver ever loads, operators establish a foothold and move laterally using ordinary remote-access and administration tools: AnyDesk for hands-on control, PsExec for remote execution, and credential-harvesting utilities to spread. Only once they have the access they need do they deploy PoisonX to neutralize endpoint defenses, then run the encryptor. The kernel step is the pivot that turns a contained intrusion into a full encryption event, because it removes the tooling that would otherwise catch the ransomware payload.
What defenders can do about signed-driver abuse
Signed-driver abuse is hard to stop with signatures alone, which is the point. Microsoft’s vulnerable-driver blocklist should be enabled and kept current, because it denies known-abusable drivers even when signed. Watch for a new kernel driver loading immediately before security services die, a strong behavioral signal. Restrict who can install drivers, monitor for AnyDesk and PsExec in environments that do not use them, and ensure backups are offline so encryption is recoverable. For control selection, see our guide to business ransomware protection.
Frequently asked questions
What is GodDamn ransomware?
GodDamn is a ransomware family Symantec attributes to the Hyadina lineage, which previously operated as Monster in 2022 and Beast in 2024. It uses a signed kernel driver to disable defenses before encrypting.
How does PoisonX bypass EDR?
PoisonX is a kernel driver that terminates security processes, tampers with kernel callbacks, and strips protections from protected processes, disabling endpoint detection from a level user-mode tools cannot defend.
Why is a Microsoft-signed malicious driver so serious?
A valid Microsoft signature means Windows trusts the driver by default. Detection based on signatures and reputation fails, so defenders must rely on behavior-based signals and driver blocklists instead.
How do I defend against BYOVD attacks?
Enable and update Microsoft’s vulnerable-driver blocklist, restrict driver installation, and alert on any new kernel driver loading just before security services stop. Keep offline backups so encryption remains recoverable.
What tools does GodDamn use before encryption?
Operators use AnyDesk for remote control, PsExec for remote execution, and credential-harvesting tools to move laterally, deploying the PoisonX driver only once they have sufficient access.