Executive Summary
A threat actor Symantec tracks as Hyadina has run three consecutive ransomware families since March 2022. Monster gave way to Beast in June 2024. Beast gave way to GodDamn in May 2026. Each rebrand brought a capability upgrade. The upgrade that came with GodDamn is different in kind from what came before.
GodDamn ships with PoisonX: a Windows kernel driver that carries a valid Microsoft Hardware Compatibility Publisher signature and terminates endpoint security processes before the encryptor runs. That signature is not incidental. It is the attack. Windows loads signed kernel-mode code automatically, and a driver operating at ring 0 can kill security tools at a level that no user-mode detection mechanism can reach.
The critical distinction from conventional bring-your-own-vulnerable-driver (BYOVD) attacks: PoisonX is not a repurposed vulnerable driver. It was built from scratch for malicious use. Someone then obtained a legitimate Microsoft certificate for it. Once distributed into the GentleKiller framework maintained by The Gentlemen ransomware-as-a-service operation, PoisonX reached affiliates operating across 70-plus countries and 478 victim organisations.
Symantec disclosed the campaign on 9 July 2026. The attacker’s ability to obtain Microsoft certification for a purpose-built EDR killer is the headline concern, but the actual risk to most defenders is more immediate: the driver targets more than 400 processes across approximately 48 security vendors and products.
Threat Actor Profile: Hyadina
The threat actor Symantec names Hyadina began operating in March 2022 with a Delphi-based ransomware family called Monster. Monster targeted 32-bit Windows systems and represented a relatively modest technical capability for its era. It was active for roughly two years.
In June 2024, Hyadina transitioned to Beast. The Beast encryptor was a meaningful upgrade: broader Windows compatibility, more robust encryption handling, and the start of what became an ongoing relationship with the ransomware ecosystem’s larger affiliate networks. Beast circulated in RaaS contexts but also ran under Hyadina’s direct operation.
May 2026 brought the GodDamn rebrand and, with it, PoisonX.
Hyadina is distinct from the operators who run The Gentlemen RaaS. The threat actor hastalamuerte, who founded The Gentlemen following a commission dispute with Qilin in 2025, is a separate entity. What connects Hyadina and The Gentlemen is that the GentleKiller framework — The Gentlemen’s operator-maintained EDR killer toolkit — incorporated PoisonX after it was weaponised. Hyadina developed both GodDamn and PoisonX. The Gentlemen distributed them.
The PoisonX Driver: Why This Is Not BYOVD
What BYOVD looks like: An attacker drops a legitimate driver that has a known vulnerability — RTCore64.sys is a common example — loads it as a kernel service, and exploits the vulnerability to execute kernel-level operations. The driver was signed before it was ever relevant to the attack. The attacker is repurposing something that exists.
What PoisonX is: A driver written specifically to kill security software. It was published on GitHub on 7 April 2026 by an account using the alias “oxfemale,” described as a research tool. It carried a valid Microsoft Hardware Compatibility Publisher certificate at the time of publication. That certificate was obtained through Microsoft’s hardware certification programme, which is designed to ensure kernel-mode code is stable and compatible with Windows — not designed as a security gate for whether the driver’s intended function is malicious.
This distinction matters enormously for detection. BYOVD defences rely substantially on blocklists of known-vulnerable drivers — the LOLDrivers project and Microsoft’s WDAC recommended block rules. PoisonX was not on any such list. It was a newly signed driver with no prior security history. The first documented use came in April 2026, when Xcitium researchers observed it being used to terminate CrowdStrike Falcon. Within weeks, it was incorporated into GentleKiller and distributed across The Gentlemen’s affiliate network.
Microsoft has since revoked the certificate, and PoisonX hashes have been added to detection feeds. But the episode illustrates a structural problem: the Windows driver signing programme does not prevent malicious drivers from obtaining valid signatures if their author can navigate the submission process. The attack surface is the certification process itself.
Technical capability: PoisonX operates at kernel level (ring 0). From that position, it can terminate security processes by process ID or name, strip kernel callbacks that security software registers to receive notifications about process activity, and remove protected process flags. A security tool whose process is terminated cannot restart itself if PoisonX removes the kernel hooks that normally enable restart protection. This is not user-mode evasion — it is surgical removal of the defensive layer.
TTPs and Tradecraft
The attack analysed by Symantec and Carbon Black began on 29 May 2026, with a five-day dwell period before the GodDamn encryptor was deployed. The reconstruction of the kill chain provides a useful picture of how Hyadina operates on target networks.
Remote access: AnyDesk was present on the affected endpoint, stored in a folder named ‘Music’ to reduce visibility. The application made outbound connections to IP addresses not associated with AnyDesk’s infrastructure, indicating operator-controlled relay. This is a common pattern for operators who have purchased access from an initial access broker: the AnyDesk session was already established before Hyadina’s hands-on activity began.
Credential access: A NirSoft-based toolkit was used for credential harvesting. NirSoft tools are legitimate utilities — password recovery products — that are routinely abused in post-exploitation phases because they produce clear-text credential output and are often not blocked by default AV/EDR configurations.
Lateral movement: PsExec. Standard, established, expected. PsExec remains in active use across ransomware operations precisely because it works reliably across Windows environments with minimal configuration.
Defence evasion (user mode): A user-mode tool disguised as a legitimate Symantec product. The technique is consistent with “name masquerading” — using the filename of a trusted vendor product to reduce alert probability in environments that rely on process name for triage prioritisation.
Defence evasion (kernel mode): PoisonX, loaded as a kernel service. This is the step that makes everything else less observable. Once PoisonX runs, the endpoint’s EDR is either terminated or blinded. Subsequent activity — including staging the GodDamn encryptor and executing it across ten hosts — occurs in a degraded detection environment.
Encryption: GodDamn. The encryptor reached ten hosts in the observed incident. The five-day dwell period allowed the attacker to validate lateral movement and stage payloads across those hosts before triggering simultaneous encryption.
GentleKiller: The Framework Context
GentleKiller is the operator-maintained EDR-killing toolkit that The Gentlemen distribute to their affiliates as part of the RaaS offering. ESET published a detailed analysis of the framework in 2026, identifying at least eight variants that abuse different drivers — a mix of vulnerable legitimate drivers and, with the addition of PoisonX, purpose-built malicious ones.
The framework targets more than 400 processes associated with approximately 48 security vendors and products. The target list includes Microsoft Defender, CrowdStrike Falcon, SentinelOne, Palo Alto Networks Cortex XDR, Sophos Intercept X, Trend Micro Apex One, ESET, Bitdefender, Trellix/McAfee, and Kaspersky, among others.
What GentleKiller represents strategically is operator-maintained offensive tooling that raises the capability floor for all affiliates. A new affiliate joining The Gentlemen does not need to develop their own EDR bypass. They receive a tested, maintained framework that is updated as old drivers are blocklisted. PoisonX’s incorporation into GentleKiller demonstrates how quickly a new offensive tool can move from individual use to widespread distribution within the ransomware ecosystem.
The Gentlemen claimed 478 victims across more than 70 countries by June 2026. Not all of those victims encountered GodDamn or PoisonX — affiliates use different tools — but all had access to GentleKiller as part of their affiliate package.
Targeting and Victim Sectors
The Hyadina-attributed attack observed by Symantec was a single-organisation incident. Ten hosts encrypted. Sector and geography are not public.
Broader targeting patterns are inferred from The Gentlemen’s affiliate activity, which spans finance, healthcare, manufacturing, government, and education across Europe, North America, and Asia-Pacific. The Gentlemen do not maintain sector-specific targeting exclusions, though the group’s known interest in non-US markets reflects deliberate geographic strategy by the operators.
For PoisonX specifically, the first documented use in April 2026 targeted an environment running CrowdStrike Falcon. The selection was likely opportunistic — the attacker knew what EDR was present and used a driver capable of killing it. The tool is not CrowdStrike-specific; it handles 400-plus processes across the full security product landscape.
Historical Context: Four Years of Continuous Operation
Hyadina’s documented timeline:
- March 2022: First Monster ransomware deployment. Delphi-based, 32-bit Windows focus.
- June 2024: Transition to Beast. More capable encryptor, broader compatibility.
- April 2026: PoisonX first used in attacks (Xcitium discovery). CrowdStrike Falcon targeted.
- May 2026: GodDamn replaces Beast. PoisonX integrated as standard component.
- July 2026: Symantec publishes analysis. PoisonX certificate revoked.
Four years of continuous operation is notable. Many ransomware developers cycle through short bursts of activity and either retire or pivot to other criminal services. Hyadina’s persistence, and the consistent capability improvement across three ransomware generations, suggests a committed operator investing in long-term development rather than opportunistic quick returns.
The Beast-to-GodDamn transition specifically — replacing a working encryptor with a new one and adding kernel-level EDR killing capability — required significant development effort. PoisonX is not a dropped-in library. It is a kernel-mode driver that had to pass Microsoft’s compatibility testing. Getting a malicious driver through that process reflects either a sophisticated approach to the submission procedure or a degree of front-company infrastructure that the ecosystem rarely documents.
Defensive Implications
Hypervisor-Protected Code Integrity (HVCI): Microsoft’s HVCI, enabled in Windows 11 and available on modern Windows 10 hardware, prevents the loading of drivers that do not meet integrity requirements set by the hypervisor. Even legitimately signed drivers can be blocked if they do not conform to the required integrity level. HVCI is the strongest available countermeasure to both BYOVD and purpose-built malicious driver attacks. Organisations that have not audited their HVCI enrollment status should do so.
Windows Defender Application Control (WDAC): WDAC’s recommended driver block rules include known-vulnerable driver hashes. Following the PoisonX disclosure, those hashes have been added to updated rule sets. Keeping WDAC block rules current is the most immediate action for organisations that cannot immediately deploy HVCI.
EDR self-protection monitoring: EDR vendors have responded to the BYOVD/malicious driver threat by implementing protected process (PPL) configurations for their agent processes. Verify that your EDR agent runs as a PPL and that process protection status is monitored. An EDR process that exits without a clean shutdown event is a high-priority alert.
Kernel callback monitoring: Advanced endpoint monitoring should include alerts for unexpected removal of kernel callbacks. PoisonX and tools like it deregister security tool callbacks as part of their blinding operation. Some EDR vendors can detect this directly; others can be configured to alert on the signal.
Service creation for kernel drivers: PoisonX is loaded as a kernel service. Detect kernel driver service creation from unexpected paths — particularly temp directories, user-writable paths, and application data folders — as a high-confidence signal. The Sigma rule category covering sc.exe create ... type=kernel combined with a non-system driver path has low false-positive rates in most enterprise environments.
Certificate revocation does not remove deployed copies: Microsoft revoked the PoisonX certificate after the July 2026 disclosure. That revocation prevents future signature validation of the specific certificate, but it does not remove copies of the driver already on-disk in affected environments. Scan for PoisonX hashes directly, rather than relying on certificate validity as the detection gate.
The structural problem: PoisonX obtained a legitimate Microsoft signature by submitting a driver through Microsoft’s hardware compatibility programme. The submission process is designed to validate stability and compatibility, not to assess intent. There is no reliable mechanism for defenders to know in advance that a newly signed driver is malicious. The response to this gap is behavioural detection — not hash blocklists alone — combined with HVCI to raise the baseline resistance to unknown kernel-mode threats.