Executive Summary
Security researchers have identified a new ransomware campaign attributed to the threat actor Hyadina, deploying a rebranded version of the Beast and Monster families now known as GodDamn. The operation is notable for its use of the PoisonX kernel driver (g11.sys), which was inexplicably granted a legitimate Microsoft Hardware Compatibility signature. This driver allows the attackers to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, effectively neutralizing endpoint protection and security software before the encryption phase.
The attack chain involves the use of dual-use tools and remote management software like AnyDesk for persistence, alongside a suite of NirSoft credential harvesting tools and Mimikatz. Hyadina primarily targets U.S.-based organizations across healthcare, manufacturing, and education sectors, showing a sophisticated ability to blend legitimate tools with custom malicious components to bypass behavioral and signature-based detections.
The use of signed drivers represents a significant escalation in defensive evasion. Because these drivers carry valid signatures, they are often automatically trusted by Windows systems, bypassing traditional security controls. Organizations must prioritize monitoring for unauthorized driver loading and unusual remote management software activity.