New Ransomware Exploits Malicious Driver to Remove Cybersecurity Protections

Symantec researchers report on GodDamn, the latest Hyadina ransomware variant observed in 2026, which leverages a Microsoft-signed malicious kernel driver (PoisonX) to terminate security products, uses AnyDesk for persistence, deploys credential-stealing tools like NirSoft and Mimikatz to escalate access, and then encrypts files for ransom; the report highlights increased defensive evasion and continued development by the threat actors.