GodDamn Ransomware Uses PoisonX Driver to Disable Defenses

A new ransomware family, dubbed GodDamn, has emerged, employing the PoisonX kernel driver to disable endpoint security defenses. This sophisticated evasion technique allows the ransomware to operate without detection by security software. The Threat Hunter Team from Symantec published a report detailing these findings, noting that GodDamn was first publicly observed in the wild on May 21, 2026. Analysis suggests that GodDamn is a rebrand of the Beast ransomware, indicating a potential evolution or rebranding effort by its operators.

The PoisonX kernel driver is a critical component of GodDamn's attack chain. By operating at the kernel level, it can directly interact with the operating system's core functions, granting it the ability to disable or bypass security measures such as antivirus software and endpoint detection and response (EDR) solutions. This level of access is typically reserved for system-level processes and provides a significant advantage to attackers seeking to maintain stealth and execute their malicious payloads unimpeded.

The Symantec report highlights that the use of such kernel-level drivers represents an increasingly advanced tactic among ransomware groups. These drivers are often custom-built or acquired from underground forums, requiring a high degree of technical expertise to develop and deploy effectively. The successful deployment of PoisonX by GodDamn signifies a growing threat landscape where attackers are leveraging sophisticated tools to overcome established cybersecurity defenses. The ransomware's primary objective, like other variants, is to encrypt victim data and demand a ransom payment for its decryption.

While the specific ransom demands and target profiles for GodDamn are still under investigation, its emergence underscores the persistent and evolving nature of ransomware threats. Cybersecurity professionals are advised to remain vigilant and ensure their endpoint security solutions are up-to-date and configured to detect and block kernel-level manipulation attempts. The rebranding from Beast to GodDamn may also suggest a shift in operational tactics or a broader campaign by the underlying threat actor group.