GodDamn

GodDamn is a financially motivated ransomware operation associated with the Hyadina cybercrime actor and assessed as the latest rebrand in the Monster -> Beast -> GodDamn lineage. Monster emerged in 2022, Beast followed as an evolved successor, and GodDamn appeared in 2026 as the third known iteration. The operation is notable for prioritizing defense evasion before encryption, particularly through use of the PoisonX malicious kernel driver in a bring-your-own-vulnerable-driver-style chain to disable or blind endpoint protection tools. Reported tradecraft also includes use of a fake Symantec-themed binary to impair defenses, remote access software for hands-on-keyboard access, credential-harvesting utilities derived from NirSoft tools, Mimikatz for credential theft, and PsExec for lateral movement and remote execution at scale. Observed intrusions show a multi-stage enterprise ransomware workflow: remote access establishment, credential theft from browsers, Windows credential stores, cached domain credentials, email clients, wireless profiles, and other local sources; network traffic capture; lateral movement across reachable hosts; persistence through auto-start services; and broad ransomware deployment after a dwell period. The operators have been observed repeating this sequence across multiple hosts in a short time window, indicating coordinated domain-wide operations rather than single-system encryption. Encrypted files are renamed with victim-specific extensions, and victims are directed to negotiate through email or qTox. The actor's tooling and procedures align with common big-game ransomware tradecraft focused on full-network compromise, data theft, and encryption. High-confidence reporting ties GodDamn to financially motivated cybercrime rather than state-sponsored activity. Known related names in the lineage include Monster and Beast; the developer or operator attribution associated with this lineage is Hyadina.