GodDamn Ransomware: Hyadina Group's Evolution of Beast Ransomware

The Hyadina threat group (formerly associated with Monster and Beast ransomware) has introduced its latest iteration, GodDamn ransomware. First observed in mid-2026, this variant continues the group's trend of evolving defense evasion tactics, most notably integrating the 'PoisonX' malicious kernel driver (g11.sys). This driver, which is Microsoft-signed, allows attackers to terminate security processes and remove API hooks at the kernel level, effectively blinding EDR and AV solutions.

Technically, the campaign involves manual delivery of remote access tools like AnyDesk followed by credential harvesting using NirSoft utilities and Mimikatz. Lateral movement is achieved through PsExec and administrative shares, while the ransomware itself supports cross-platform targeting of Windows, Linux, and VMware ESXi environments. The ransomware typically avoids targeting systems located within the Commonwealth of Independent States (CIS).

Hyadina has transitioned from a Delphi-based payload to C and Go, reflecting a maturing development cycle aimed at higher efficiency and customizability. The group operates as a Ransomware-as-a-Service (RaaS), significantly increasing the risk to global organizations through a wide affiliate network and sophisticated defense evasion capabilities.