TL;DR: On July 8, 2026, Symantec's Threat Hunter Team documented "GodDamn," a rebrand of the Beast and Monster lockers under the Hyadina ransomware-as-a-service (RaaS) operation. GodDamn uses a Microsoft-signed kernel driver called PoisonX to disable endpoint defenses in a bring-your-own-vulnerable-driver (BYOVD) attack, then chains PsExec for lateral movement and NirSoft utilities for credential harvesting before encrypting the environment. For North Carolina SMBs running Windows 10/11 endpoints on Defender, SentinelOne, or CrowdStrike without WDAC or the Microsoft Vulnerable Driver Blocklist enforced, GodDamn can blind your EDR before you see the first alert.
Key takeaway: The most dangerous line in the GodDamn kill chain is not the ransom note. It is the moment PoisonX loads into the Windows kernel with a valid Microsoft signature and removes user-mode API hooks that every commercial EDR relies on. From that instant, your SOC dashboard shows a healthy endpoint while the attacker owns kernel-space code execution. NC SMBs without kernel-level driver policy enforcement have no realistic path to detect this.
Need to close the kernel-driver gap GodDamn exploits before your next audit? Contact Preferred Data Corporation - BBB A+ rated, 37+ years of NC IT expertise, on-site within 200 miles of High Point. Call (336) 886-3282.
What Is GodDamn Ransomware and Why Did Beast Rebrand Now?
GodDamn is the July 2026 rebrand of the Beast ransomware family, itself a prior rebrand of Monster, operated by the Hyadina RaaS group. Three data points frame the risk profile for NC SMBs.
- First observed June 3, 2026. Symantec's Threat Hunter Team documented the first GodDamn intrusion on June 3, 2026, on a segmented network belonging to a US-based organization, and published detailed analysis on July 8.
- Rebrand pattern is deliberate. Beast, Monster, and now GodDamn are sequential public brands over the same Hyadina RaaS backbone. Rebrands let affiliates continue operations while dodging law-enforcement takedowns, sanctions listings, and cyber-insurance blocklists that key on the older names.
- PoisonX is the innovation. Prior Beast/Monster variants relied on off-the-shelf BYOVD utilities (KillAV, EDRSilencer, and similar). GodDamn ships a purpose-built PoisonX driver that the operators successfully got Microsoft to co-sign, dramatically raising the trust score of the driver at load time.
The rebrand cadence matters for NC SMB defenders because your cyber-insurance carrier, MDR vendor, and threat-intel feeds may still key their block/allow lists on "Beast" or "Monster" indicators. Any signature or IOC that keys on the old brand names will miss GodDamn intrusions in progress.
How Does the PoisonX BYOVD Attack Actually Work?
The end-to-end PoisonX chain has five stages, all executed under the identity of a signed kernel driver.
- Initial access via phished credentials or exposed RDP/VPN. Symantec observed GodDamn intrusions beginning with typical initial-access vectors: phishing-derived Microsoft 365 credentials, exposed RDP endpoints, and compromised MSP tooling. No zero-day is required to get in.
- PoisonX driver installation with valid Microsoft signature. The operators load PoisonX with
sc createand start it as a kernel-mode service. Because the driver carries a legitimate Microsoft co-signing signature, Windows Driver Signature Enforcement (DSE) accepts the load without prompting the user or the endpoint agent. - User-mode API hook removal. PoisonX unlinks the user-mode hooks that EDR products (Microsoft Defender for Endpoint, SentinelOne, CrowdStrike Falcon, Cortex XDR) install to observe process behavior. After this step, the EDR agent is still running but is functionally deaf to the malicious activity.
- Security-process termination and API kill. PoisonX kills security-related processes and removes user-mode API hooks that let endpoint security tools observe process behavior on the host. This includes the local EDR sensor, the local antimalware service, and any host-based DLP agent.
- Payload deployment via PsExec + NirSoft. With defenses blinded, the operators use PsExec for lateral movement to file servers and NirSoft credential recovery utilities (Mail PassView, WebBrowserPassView, ChromePass) to harvest additional credentials, then deploy the GodDamn locker to encrypt shares and workstations.
Detection dwell time between PoisonX load and ransomware execution has been measured in single-digit hours in Symantec's incident sample. NC SMBs without WDAC or Vulnerable Driver Blocklist enforcement, and without kernel-level EDR telemetry, will not detect the driver load in real time.
Why Should NC Small Businesses Care About "Kernel Driver Attacks"?
The instinctive reaction, "kernel-driver attacks are nation-state stuff," is wrong for three reasons that specifically apply to NC SMBs.
- Hyadina is a RaaS operator, not a nation-state. GodDamn is deployed by financially motivated affiliates against mid-market and small-business targets, not against Fortune 500 defense contractors. The affiliate model is designed for volume against SMBs.
- Microsoft's Vulnerable Driver Blocklist has a delivery lag. Microsoft maintains a Vulnerable Driver Blocklist to block known dangerous drivers from loading even if they have a valid signature. However, there is a lag of days, more often weeks, between a driver being identified and the blocklist update reaching enterprise endpoints. During that window, defenders must enforce their own policies.
- Cyber-insurance carriers now audit for it. Renewal questionnaires for NC SMB cyber policies in 2026 explicitly ask whether Windows Defender Application Control (WDAC) is enforced, whether the Microsoft-Recommended Vulnerable Driver Blocklist is enabled, and whether kernel-driver load events are monitored. A "no" answer materially raises premiums or forces sublimits on ransomware coverage.
For NC SMBs with 25 to 250 endpoints, the operational reality is that WDAC enforcement is now table stakes for renewal-grade cyber posture, not a nice-to-have.
Key takeaway: The Windows Vulnerable Driver Blocklist is enabled by default only on Windows 11 22H2 and newer, on Windows 10 systems with the March 2023 or later cumulative update AND memory-integrity enabled, and on managed devices where the policy is explicitly deployed. If your NC SMB fleet has Windows 10 endpoints without memory integrity, or Windows 11 endpoints where MDM has not confirmed policy application, you are not protected by default.
What Are the Immediate Actions for NC SMBs to Neutralize GodDamn-Class Risk?
Emergency hardening runs in three parallel workstreams across 30 to 60 days.
Workstream 1: Kernel-driver policy enforcement (Days 0-14).
- Verify the Microsoft-Recommended Vulnerable Driver Blocklist is enabled on every Windows 10 and 11 endpoint. On Windows 11 22H2+, confirm the policy is active via
Get-CIPolicyor Intune device compliance. On Windows 10, enable memory integrity via Group Policy or Intune and apply the blocklist. - Deploy Windows Defender Application Control (WDAC) in audit mode fleet-wide for 14 days, then transition privileged and finance user groups to enforced mode with a helpdesk exception workflow.
- Configure your EDR/MDR platform to alert on unsigned or newly signed kernel driver loads from user-writable directories (
C:\Windows\Temp,C:\Users\*\AppData,C:\ProgramData\*).
Workstream 2: Lateral-movement and credential-harvest controls (Days 0-30).
- Block PsExec, PAExec, and functionally equivalent tools at the endpoint level via WDAC, AppLocker, or your EDR platform. Legitimate admin use of PsExec is near zero for most NC SMBs, and any legitimate use can be exempted per-user.
- Block the NirSoft utility suite (Mail PassView, WebBrowserPassView, ChromePass, PasswordFox, NetworkPasswordRecovery) at the endpoint level. NirSoft signs its binaries, which trips reputation-based controls, but the utilities are indistinguishable from an attacker's credential-recovery kit in an incident.
- Enforce Local Administrator Password Solution (LAPS) or an equivalent random-per-host local admin password scheme, so PoisonX-driven PsExec cannot pivot laterally with a single stolen local admin credential.
Workstream 3: MDR-grade detection and incident retainer (Days 0-60).
- Deploy or upgrade to an MDR agent with kernel-level telemetry, not just user-mode process-behavior telemetry. Kernel-mode telemetry survives PoisonX's user-mode hook removal.
- Establish a 24/7 SOC-monitored escalation path so a suspicious kernel-driver load at 2:00 AM triggers a human analyst before the ransomware deployment.
- Retain an incident-response provider on paper, so that on the morning of an intrusion your team is not shopping for an IR firm at $1,500/hour under duress.
Explore Preferred Data's cybersecurity services
GodDamn vs Prior Ransomware Rebrand Lineage: How Do the SMB Impacts Differ?
The Hyadina RaaS operation has cycled through three public brands. The SMB defensive posture must key on behavior, not brand.
| Ransomware Brand | First Observed | Signature Attack Innovation | SMB Detection Difficulty |
|---|---|---|---|
| Monster | 2023 | Off-the-shelf BYOVD (KillAV, EDRSilencer) | Medium (many blocklists caught) |
| Beast | 2024 | Cross-platform Linux + Windows lockers | Medium (broader signature coverage) |
| GodDamn | June 2026 | Purpose-built Microsoft-co-signed PoisonX driver | High (co-signed, evades blocklist lag) |
The Hyadina family's rebrand cadence, roughly every 12 to 18 months, means NC SMBs cannot rely on brand-name signatures. The durable controls are behavior-based: kernel-driver load monitoring, WDAC enforcement, PsExec/NirSoft blocking, and MDR-grade incident response.
Explore Preferred Data's managed IT services
How Does Preferred Data Help NC SMBs Defend Against GodDamn-Class Ransomware?
Preferred Data Corporation delivers WDAC rollout, MDR-grade kernel telemetry, and 24/7 SOC escalation for NC manufacturers, healthcare providers, financial institutions, contractors, and professional services firms. With 37+ years of NC IT expertise, an average client retention of 20+ years, and an on-site radius of 200 miles from High Point, we can close the kernel-driver exposure this quarter.
- 72-hour kernel-driver audit. Discovery of unsigned driver loads, off-blocklist signed drivers, and Vulnerable Driver Blocklist enforcement gaps across your Windows fleet.
- WDAC deployment engagement. Structured audit-mode rollout, staged enforced-mode migration for privileged and finance users, and a helpdesk exception workflow.
- 24/7 MDR + SOC monitoring. Kernel-telemetry escalation of PoisonX-class driver loads with human analyst review inside 15 minutes of alert.
- Cyber-insurance renewal support. Documented WDAC evidence, kernel-telemetry logs, and CISA-aligned remediation records to keep renewal premiums flat.
Ready to close the kernel-driver door before the next Hyadina rebrand ships PoisonX v2? Call (336) 886-3282 or contact our team.
Frequently Asked Questions
Does antivirus block PoisonX?
Signature-based antivirus alone is not reliable against PoisonX. The driver carries a valid Microsoft co-signing signature, so Windows Driver Signature Enforcement (DSE) accepts the load and reputation-based AV controls treat it as trusted. The durable control is WDAC or the Vulnerable Driver Blocklist, which allow-lists on specific driver hashes rather than trusting the signature alone.
Is the Microsoft Vulnerable Driver Blocklist enabled by default on my Windows fleet?
Not on every version. It is enabled by default on Windows 11 22H2 and newer, and on Windows 10 with memory integrity enabled and the March 2023 or later cumulative update. Managed devices where policy has not been explicitly deployed via Intune, Group Policy, or a WDAC XML policy will not have it enforced. Audit your fleet with Get-CIPolicy or Intune device-compliance reports.
Does WDAC break user productivity?
If deployed carelessly, yes. The correct rollout is: audit-mode logging for 2-3 weeks to build the actual publisher and file-hash inventory, whitelist the top 95% of legitimate publishers, then flip to enforced mode with a helpdesk workflow for exceptions. Well-run rollouts add less than 1% helpdesk load after month 2.
Should we block PsExec at the endpoint level?
For most NC SMBs, yes. Legitimate admin use of PsExec is near zero on a properly managed fleet where Intune, ConnectWise Automate, N-able N-central, or an equivalent RMM handles remote administration. Blocking PsExec and PAExec at the endpoint closes a top lateral-movement vector that GodDamn and dozens of other ransomware families rely on.
Is Beast ransomware the same as GodDamn?
Operationally, yes. Symantec's July 8, 2026 analysis identifies GodDamn as a rebrand of Beast, itself a rebrand of Monster, all operated by the Hyadina RaaS group. The brand name changes; the affiliate network, the toolkit lineage, and the operating pattern do not. Your defensive controls should key on the behavior (BYOVD, PsExec, NirSoft), not the brand.
How fast can Preferred Data audit our fleet for kernel-driver risk?
For an active NC SMB inside our 200-mile service radius, a kernel-driver and WDAC-readiness audit begins within one week and the written report lands inside three weeks. Call (336) 886-3282 to schedule.