'GodDamn' Ransomware Uses BYOVD to Smite US Companies

Hyadina, a ransomware-as-a-service operation, has been observed deploying a new locker named "GodDamn" against U.S. organizations and using a malicious, Microsoft-signed kernel driver called PoisonX to disable endpoint defenses. The attackers combine legitimate remote-management tools (AnyDesk, RMM), a suite of open-source credential stealers (mostly NirSoft tools and Mimikatz), and lateral movement utilities to entrench and encrypt victims, highlighting the risk posed by signed vulnerable drivers and the lagging Microsoft blocklist.