GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

Symantec analysts attribute recent GodDamn ransomware activity to the Hyadina group (a rebrand lineage from Monster→Beast→GodDamn). The report details a May–June 2026 campaign where operators used AnyDesk for persistent remote access, a NirSoft-based credential-harvesting toolkit (including Mimikatz), PsExec for lateral movement, and a signed malicious kernel driver (PoisonX) to disable endpoint defenses before deploying the GodDamn encryptor; it includes numerous file-hash IOCs and mitigation guidance.