Ransomware Employs Microsoft-Signed Malicious Driver to Disable EDR and Target 10 Hosts Before Encryption
Recent cybersecurity developments have unveiled a significant threat posed by a ransomware group known as GodDamn, which has reportedly been operating since March 2022. This group has increasingly sophisticated methods of evading detection, culminating in its recent deployment of a highly advanced kernel driver designed specifically to disable endpoint security software. This newly introduced driver, referred to as PoisonX, is particularly troubling due to its valid signature from Microsoft, raising pertinent questions about the integrity of its driver signing process.
On July 9, 2026, a media source disclosed the capabilities of GodDamn, highlighting that the group had successfully used PoisonX to compromise at least ten machines within a single organization before any response could be initiated. Unlike traditional ransomware that evades security by exploiting weaknesses, this approach completely shuts down security measures, rendering them ineffective. The implications are significant for any organization operating Windows endpoints, as they may be vulnerable to a coordinated and stealthy attack that disables their defenses entirely prior to data encryption.
The origin and operational tactics of the Hyadina group, which is tracked under the umbrella of GodDamn, raise concerns. Initially known for its Monster ransomware and subsequently rebranded as Beast, the group has primarily targeted sectors such as healthcare, manufacturing, and education within the United States. Their strategic avoidance of systems located in the Commonwealth of Independent States indicates a calculated approach to their criminal activities.
Understanding the operation of PoisonX requires an awareness of how Windows manages software trust. The operating system utilizes different privilege levels, or rings, to control access to system resources. PoisonX operates in a privileged state (Ring 0), bypassing the protective layers that typical security applications operate within (Ring 3). This structural dynamic permits PoisonX to directly terminate security processes, effectively reducing these tools to passive interfaces devoid of actionable threat detection.
The legitimacy of Microsoft’s signature on PoisonX is a stark reminder of potential vulnerabilities within its driver signing program. Microsoft’s verification process confirms publisher identity but does not assess the behavior or intent behind a driver’s development. Consequently, malicious actors could potentially exploit this system to gain trust and legitimacy for tools that serve no constructive purpose.
Cybersecurity experts are urging organizations to strengthen their defenses against these emerging threats. Approaches such as enabling Hypervisor-Protected Code Integrity (HVCI), implementing Windows Defender Application Control (WDAC) policies, and proactive event monitoring are critical measures that can provide substantial protection against this sophisticated strain of ransomware. As this threat landscape evolves, organizations must remain vigilant and continuously adapt their cybersecurity strategies to prevent exploitation by groups like Hyadina and their increasingly advanced techniques.
#business #technology #environment
