GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses

Cybersecurity researchers have identified a new ransomware family known as GodDamn, which utilizes the PoisonX kernel driver to evade detection by disabling endpoint defenses. The GodDamn ransomware was first spotted in the wild on May 21, 2026, and is believed to be a rebranded version of the Beast ransomware. This ransomware family employs a defense evasion strategy that involves neutralizing security software. The discovery was made by the Threat Hunter Team from Symantec, who published a report on the findings. The use of the PoisonX kernel driver is a key component of GodDamn's evasion tactics.