The threat actor tracked as Hyadina by Symantec has operated ransomware continuously since March 2022, cycling through three successive families — Monster, Beast, and now GodDamn — with each generation bringing meaningful capability upgrades. The current iteration, GodDamn, arrived in May 2026 alongside a kernel-level EDR killer called PoisonX that carries a valid Microsoft Hardware Compatibility Publisher signature. Symantec disclosed an active intrusion on 9 July 2026.
Ransomware Family Timeline
| Period | Family | Notes |
|---|---|---|
| March 2022 — June 2024 | Monster | Delphi-based, 32-bit Windows focus |
| June 2024 — May 2026 | Beast | Broader compatibility, active in RaaS distribution |
| May 2026 — present | GodDamn | Adds PoisonX kernel driver, incorporated into GentleKiller |
The renaming pattern is consistent with ransomware developers who want to reset brand associations when law enforcement or vendor attention increases. Each successor has been more capable than the one it replaced.
PoisonX: Not a Vulnerable Driver, a Malicious One
Traditional BYOVD attacks repurpose legitimate signed drivers that have exploitable vulnerabilities — RTCore64.sys being the canonical example. PoisonX is different. It was built from scratch to kill endpoint security, and its author (operating under the GitHub alias “oxfemale”) successfully obtained a valid Microsoft signature for it before publication on 7 April 2026, where it was described as a research tool.
A legitimately signed kernel driver loads automatically on Windows without user prompts. Operating at ring 0, PoisonX can:
- Terminate EDR and AV processes by name or PID
- Strip kernel callbacks that security tools register to monitor system activity
- Remove protected process flags that prevent security agent processes from being killed from user mode
The driver targets more than 400 processes associated with approximately 48 security vendors. Microsoft has since revoked the certificate, and the driver hashes have been added to detection feeds, but the underlying technique — obtaining a valid certificate for a purpose-built offensive driver — remains a structural problem.
Attack Profile: Observed Intrusion (May — June 2026)
Symantec and Carbon Black reconstructed an attack that began on 29 May 2026 and culminated in encryption five days later, hitting ten hosts inside a single organisation.
Tools used:
- AnyDesk (stored in a folder named ‘Music’) for persistent remote access
- NirSoft credential harvester for credential theft
- PsExec for lateral movement
- User-mode evasion tool disguised as a Symantec product
- PoisonX to kill EDR at kernel level before the encryptor ran
The five-day dwell period is consistent with careful affiliate operations: validate access, enumerate targets, stage the encryptor across all intended hosts, then trigger simultaneous encryption to minimise response time.
GentleKiller: Distribution Vehicle for PoisonX
GodDamn and PoisonX moved beyond Hyadina’s own operations when The Gentlemen ransomware-as-a-service operation incorporated PoisonX into GentleKiller, the EDR-killer framework they distribute to affiliates.
GentleKiller has at least eight driver variants. Affiliates can select drivers suited to the EDR product present in their target environment. PoisonX is one of the most capable variants in the framework because it operates at kernel level without depending on a pre-existing vulnerability in the driver.
The Gentlemen claimed 478 victims across more than 70 countries by June 2026. Not all of those engagements used PoisonX, but all had access to the GentleKiller toolkit as part of their affiliate package.
Defensive Notes
HVCI (Hypervisor-Protected Code Integrity) is the most effective control. HVCI enforces a stricter signature and integrity policy at the hypervisor level, making it significantly harder to load a malicious kernel driver even one with a valid certificate. Organisations on Windows 11 should verify HVCI enrollment; those on Windows 10 should evaluate compatibility.
WDAC block rules have been updated to include PoisonX hashes following the July 2026 disclosure. Keeping WDAC current is the minimum response for organisations that have not yet deployed HVCI.
Kernel service creation monitoring — detecting sc.exe create ... type=kernel from non-system paths — provides a behavioural detection signal that catches PoisonX loading regardless of what hash or certificate it carries.
EDR process exit monitoring — alerting when your own security agent exits without a clean shutdown — is the last-resort signal that the driver has already run. Acting on this signal fast enough to interrupt encryption requires that the alert fires within seconds of the exit event.
The certificate revocation means new deployments of PoisonX with the same signature will be blocked on patched systems. It does not remove copies already present in compromised environments.