Home › Threat Actors › Hyadina (GodDamn / Beast / Monster)
← All Threat Actors
Cybercrime high Not geographically or nationally attributed in current reporting.

Hyadina (GodDamn / Beast / Monster)

Ransomware operator tracked by Symantec as Hyadina, distinct from The Gentlemen RaaS operation (founded by the actor hastalamuerte following a 2025 commission dispute with Qilin). Hyadina developed both the GodDamn ransomware and the PoisonX driver; The Gentlemen incorporated PoisonX into their operator-maintained GentleKiller EDR-killer framework and distributed it to affiliates. · Financial — ransomware extortion, with continuous capability investment across three successive encryptor generations since 2022.

Reports 1
Active Since March 2022 (as Monster, a Delphi-based 32-bit Windows ransomware)
Last Reported 27 Jul 2026
Sectors Targeted finance, healthcare, manufacturing, government, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • AnyDesk configured for unattended access with two auto-start services, hidden in a folder named Music; payloads staged in the Music and Downloads folders
  • 14-tool NirSoft credential toolkit plus Mimikatz; Netscan for reconnaissance; admin shares mounted with stolen credentials
  • Defender real-time monitoring disabled via PowerShell; a user-mode tool disguised as a Symantec product (symantec.exe)
  • PoisonX: a purpose-built Windows kernel driver carrying a valid Microsoft Hardware Compatibility Publisher signature (dropped as g11.sys), used to terminate security processes — Symantec calls it a malicious signed driver, not a vulnerable legitimate one (some press calls it BYOVD)
  • Earlier Beast activity (June 2025) used Gmer, Defender Control and IObit Unlocker
  • Observed incident: first malicious activity 29 May and encryption detected 3 June 2026 (about four days, not five), 10 hosts encrypted; files renamed with the victim's name as the extension
  • Monster is 32-bit Windows only; Beast targets Windows, Linux and ESXi; Monster and Beast avoided CIS-region machines

Known Targets

Single Symantec-observed incident: sector/geography not public (10 hosts encrypted)Broader exposure via The Gentlemen affiliate activity: finance, healthcare, manufacturing, government, and education across Europe, North America, and Asia-Pacific

Analyst Notes

Lineage: Monster (March 2022) → Beast (June 2024) → GodDamn (May 2026), each a capability upgrade. PoisonX first documented in the wild in April 2026 (targeting CrowdStrike Falcon), published to GitHub 7 April 2026 as a purported research tool. Symantec disclosed the GodDamn/PoisonX campaign 9 July 2026; Microsoft has since revoked the certificate, but revocation does not remove already-deployed driver copies. Update (research pass): the dwell figure was corrected to about four days per Symantec; the GodDamn disclosure date of 21 May 2026 is consistent. Aggregator-only claims (aliases such as DragonForce, The Gentlemen and FAMOUS CHOLLIMA, and a US-healthcare focus) were rejected as unreliable. The link between Hyadina and The Gentlemen/GentleKiller could not be re-verified in this pass because the source page was inaccessible. Symantec lists no ATT&CK IDs; those below are the site's own mapping.

Also Known As

GodDamnBeastMonster

MITRE ATT&CK Techniques

T1562.001 Impair Defenses: Disable or Modify Tools T1003 OS Credential Dumping T1569.002 System Services: Service Execution T1486 Data Encrypted for Impact

Intelligence Reports

Analysis financehealthcare

GodDamn / Hyadina -- The Beast Rebrand That Ships With a Microsoft-Signed EDR Killer

The threat actor Symantec tracks as Hyadina has run three successive ransomware families since 2022. The latest, GodDamn, arrives paired with PoisonX -- a kernel driver that carries a valid Microsoft signature and kills endpoint defences before encryption starts. This is not a BYOVD attack. The driver was built for this purpose, and then it got a legitimate certificate.

27 Jul 2026 · 10 min read