GodDamn ransomware deploys Microsoft-signed PoisonX driver to blind EDR

Symantec tracked a new Hyadina ransomware rebrand called GodDamn.

The attack chain uses a malicious kernel driver named PoisonX (g11.sys) that carries a valid Microsoft signature, enabling a BYOVD-style defense evasion. Once loaded, it terminates security processes and strips API hooks.

The operators also used a fake Symantec binary, Mimikatz, 13 NirSoft credential tools, AnyDesk, and PsExec to move laterally and encrypt at least 10 hosts.