Symantec Traces GodDamn Ransomware to Beast and Details PoisonX Defense Evasion
Summary
Symantec traces GodDamn to the Beast/Monster ransomware lineage and describes a June 2026 intrusion using PoisonX, credential-harvesting tools, AnyDesk and PsExec. Initial access was unknown; AnyDesk deployment reached at least 10 hosts before ransomware detection.
Key points
- Symantec assesses GodDamn as the latest rebrand of Beast, itself a rebrand of Monster, and associates the ransomware families’ developer with Hyadina.
- In the investigated intrusion, initial access was unknown; the earliest observed malicious activity was AnyDesk appearing in a nonstandard user Music folder on May 29, 2026.
- Attackers staged a 14-tool credential-harvesting toolkit, including Mimikatz and NirSoft tools, to recover credentials from sources such as browsers, Windows Credential Manager and Wi-Fi profiles.
- A fake Symantec-labeled tool dropped the PoisonX kernel driver, which Symantec says can terminate security-product processes and remove user-mode API hooks. Its signature was attributed to Microsoft Windows Hardware Compatibility Publisher.
- PsExec was used for reconnaissance and lateral movement. Attackers configured AnyDesk for unattended access and persistence; the deployment sequence was repeated on at least 10 hosts by June 2.
- GodDamn was first detected in the investigated environment on June 3. Encrypted files were renamed with the victim organization’s name as the extension; Symantec notes this differed from the .God8Damn extension used in some attacks.
Article Details
- Attack Vectors
- The initial infection vector is unknown. The earliest observed activity was AnyDesk appearing in a user's Music folder on May 29, 2026, which Symantec says is consistent with manual delivery after earlier access to the host.
- Attackers staged a credential-harvesting toolkit containing Mimikatz and multiple password-recovery tools; the toolkit could collect credentials from browsers, Windows Credential Manager, cached domain credentials, Wi-Fi profiles, and other sources.
- Attackers used PsExec and stolen credentials to move laterally, mount an administrative share, and run commands on remote hosts.
- A fake Symantec-labeled tool and the PoisonX kernel driver were used to disable endpoint defenses; PoisonX could terminate security-product processes and remove user-mode API hooks.
- AnyDesk was configured for unattended access and persistence through auto-start services, and the deployment was repeated across at least 10 hosts.
- GodDamn ransomware was detected on June 3, 2026. It encrypted files, which in the investigated incident were renamed using the victim organization's name as the extension.
- Defensive Notes
- The article gives no specific mitigation steps and directs readers to the Symantec Protection Bulletin for the latest protection updates.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944 | Hash of the PsExec binary identified in the campaign; attackers used PsExec to push commands to remote hosts. |
| SHA256 | 17fb52476016677db5a93505c4a1c356984bc1f6a4456870f920ac90a7846180 | Hash of NetPass, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 19bab15a34d5ad838ccf4d187eb40379c335fa56446d0f9621865b2767d4ac7d | Hash of WirelessKeyView, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d | Hash of the PoisonX driver, which attackers used to disable endpoint security processes and remove user-mode API hooks. |
| SHA256 | 31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc | Hash of Mimikatz, included in the attackers' staged credential-harvesting toolkit. |
| SHA256 | 35296e7a34688ca3e3159bcdf92b4d60ba4173a2369aca531bb7bc959f68ed9c | Hash of CredentialsFileView, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 45126297c07c6ef56b51440cd0dc30acf7b3b938e2e9e656334886fe2f81f220 | Hash of the AnyDesk binary attackers deployed and configured for unattended remote access and persistence. |
| SHA256 | 5be325905df8aab7089ab2348d89343f55a2f88dadd75de8f382e8fa026451bd | Hash of MailPassView, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 5c4c98d774eb100f9a89ae4e984c27a4f532e58c7cf8c87046dc87db5a065404 | Hash of ChromePass, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 5e85446910e732111ca9ac90f9ed8b1dee13c3314d2c5117dcf672994ce73bd6 | Hash of PstPassword, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26 | Hash of MessengerPass, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019 | Hash of VNCPassView, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 8e4b218bdbd8e098fff749fe5e5bbf00275d21f398b34216a573224e192094b8 | Hash of OperaPassView, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 8ff1c1967841a595d996a649c8134b7a5970dcf94624b237d1b089e7c6266167 | Hash of WebBrowserPassView, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | 9fae3f15900e13ec3860a109555ecd33ca43d38907c63438c50a2d6d91bfee1d | Hash of Netscan, which attackers staged to map reachable hosts on the network. |
| SHA256 | b29f91a440527fb621d106a2048f6379fff3263c60aeda9c82ff8c1d5ae880a8 | Hash of the fake Symantec-labeled defense-evasion tool that dropped the PoisonX driver. |
| SHA256 | c92580318be4effdb37aa67145748826f6a9e285bc2426410dc280e61e3c7620 | Hash of SniffPass, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | e097f3b445b63b07afacde8d6a67f0be654dd51e228a3610fb0710a1f7e29a69 | Hash of the GodDamn ransomware binary detected in the incident. |
| SHA256 | ece33e4b7e2d26eeca8ad9db4439f9801a7a77e332611116156738b1b0316046 | Hash of ExtPassword, listed among the credential-harvesting tools staged in the campaign. |
| SHA256 | faca9e856c369b63d6698c74b1d59b062a9a8d9fe84b8f753c299c9961026395 | Hash of PasswordFox, listed among the credential-harvesting tools staged in the campaign. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe staged credential-harvesting toolkit included Mimikatz and tools for collecting cached domain credentials.T1016 · System Network Configuration DiscoveryThe session on Computer 2 began with network reconnaissance using ipconfig.T1021.002 · SMB/Windows Admin SharesAttackers used PsExec to run commands on remote hosts and mounted an administrative share using stolen credentials.T1036.005 · Match Legitimate Resource Name or LocationThe defense-evasion executable was named symantec.exe to impersonate a Symantec product.T1057 · Process DiscoveryThe attackers used tasklist during reconnaissance to inspect processes.T1059.001 · PowerShellAttackers used PowerShell commands to configure AnyDesk, disable Defender monitoring, and run their deployment script.T1059.003 · Windows Command ShellThe attackers used cmd to launch the staged defense-evasion executable.T1078 · Valid AccountsAttackers used stolen credentials to mount an administrative share on an adjacent host.T1219 · Remote Access ToolsAttackers used AnyDesk for remote access and configured it for unattended connections to deployed hosts.T1486 · Data Encrypted for ImpactGodDamn encrypted files on compromised hosts.T1543.003 · Windows ServiceAttackers registered AnyDesk as auto-start Windows services named AnyDeskService and AnyDesk_D.T1555.003 · Credentials from Web BrowsersThe toolkit included browser password-recovery tools such as WebBrowserPassView and ChromePass.T1555.004 · Windows Credential ManagerThe article says the staged toolkit could recover credentials from Windows Credential Manager.T1562.001 · Disable or Modify ToolsAttackers disabled Windows Defender real-time monitoring with Set-MpPreference.
Threat Actors
Malware
BeastSymantec’s analysis shows that GodDamn is the latest rebrand of Beast, which traces back to Monster and is associated with the developer Hyadina.GodDamnSymantec’s analysis shows that GodDamn is the latest rebrand of Beast, which traces back to Monster and is associated with the developer Hyadina.MonsterSymantec’s analysis shows that GodDamn is the latest rebrand of Beast, which traces back to Monster and is associated with the developer Hyadina.PoisonXThe attack used AnyDesk, a NirSoft credential-harvesting toolkit, PsExec, and the PoisonX driver to disable defenses and deploy the ransomware across multiple hosts.
Products
AnyDeskThe attack used AnyDesk, a NirSoft credential-harvesting toolkit, PsExec, and the PoisonX driver to disable defenses and deploy the ransomware across multiple hosts.Windows Defender[T1562.001 ] Disable or Modify Tools – Windows Defender real-time monitoring was disabled (‘Set-MpPreference -DisableRealtimeMonitoring $true’).
Tools
Mimikatz[T1003 ] OS Credential Dumping – A NirSoft-based toolkit and Mimikatz were staged to collect stored credentials from browsers, Windows Credential Manager, Wi-Fi profiles, and other sources (‘the toolkit comprised 14netscanNetscan.exe, which can map the network, was also placed in the staging directory, likely to assist in mapping reachable hosts.PsExecThe attack used AnyDesk, a NirSoft credential-harvesting toolkit, PsExec, and the PoisonX driver to disable defenses and deploy the ransomware across multiple hosts.