GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses

Symantec and other vendors observed an active ransomware campaign attributed to the Hyadina group using a rebranded family called GodDamn. Operators employed a signed malicious kernel driver (PoisonX) in a BYOVD technique to neutralize security products, used credential harvesting tools and AnyDesk/PsExec for persistence and lateral movement, and encrypted files across multiple hosts in June 2026.