Sep 12, 2026 · 27 min
Ransomware rebrand uses vulnerable drivers to disable defenses
A beast by any other name. [Research Saturday]
The GodDamn campaign shows how attackers combine familiar access and credential-theft tools with signed-driver abuse to accelerate ransomware attacks.
- 1Hyadina evolved from Monster to Beast to GodDamn, using rebranding to reduce attention and pressure.
- 2Attackers combined AnyDesk, masquerading, credential theft, and the PoisonX vulnerable driver to disable endpoint protections.
- 3Rapid ransomware alerts, layered security, and enterprise-wide response planning remain central defenses against encryption and extortion-only attacks.
Don't miss
O’Gorman explains how the PoisonX vulnerable driver let attackers terminate endpoint security processes before deploying ransomware.
The brief
Symantec threat hunter Brigid O’Gorman traces Hyadina’s progression from Monster to Beast to GodDamn, arguing that ransomware groups rebrand partly to reduce attention and pressure.
The intrusion surfaced through suspicious AnyDesk activity, including an installation hidden in an unusual music-folder location, while the precise initial access vector remained unknown.
The campaign paired credential-harvesting tools such as Mimikatz with masquerading and PoisonX, a bring-your-own-vulnerable-driver technique used to terminate endpoint security processes.
The episode’s central warning is operational: organizations need effective security software, rapid pre-ransomware alerts, and plans for attacks that can spread across the enterprise.
Ransomware is also moving beyond encryption, with extortion-only operations and data theft creating pressure even when attackers never deploy encryption malware.