Loading malware…
PoisonX is a malicious Windows kernel driver used to disable endpoint security and conceal attacker activity. It carries a valid Microsoft Windows Hardware Compatibility Publisher signature, allowing attackers to load a purpose-built malicious component through the Windows driver trust mechanism. Unlike conventional bring-your-own-vulnerable-driver attacks, PoisonX does not merely repurpose a vulnerable legitimate driver.
PoisonX exposes a user-mode interface that accepts process identifiers and invokes kernel routines to terminate the corresponding processes, including Protected Process Light-protected security agents such as CrowdStrike Falcon. It also supports process and network-traffic concealment through kernel hooks and filtering, and has been used to remove user-mode API hooks employed by endpoint security products. These capabilities reduce security visibility and resistance to subsequent intrusion stages.
PoisonX was observed in April 2026 spearphishing campaigns targeting organizations in Japan and China. HR-themed emails linked to malicious downloads, with PXDropper installing the driver alongside the modular 10FXRAT remote access trojan. PoisonX is a separate component from 10FXRAT, which is also called PoisonX RAT. Hyadina-linked operators subsequently deployed PoisonX through an executable impersonating a Symantec product to weaken endpoint defenses before deploying GodDamn ransomware.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
From here, the attackers used an executable file disguised as a Symantec product to drop PoisonX, a malicious kernel driver which carries a legitimate Microsoft Windows Hardware Compatibility Publisher signature into the system driver store and is used to terminate security product processes, further lowering the defenses of the system.
この攻撃では、「PoisonX」と呼ばれるカーネルドライバと遠隔操作機能を持つ「10FXRAT(別名:PoisonX RAT)」が悪用されていることを確認しています。
41 distinct techniques documented for this family, organized by ATT&CK tactic.
It is not known how the signature was attained, but common methods of achieving this include usen stolen corporate identities to sign off the driver
LAC WATCH report published 2026-06-04 describing a spearphishing campaign against organizations in Japan and China that chains a malicious LNK downloader into the PoisonX BYOVD driver, a PXDropper component, and the 10FXRAT remote-access trojan.
攻撃はスピアフィッシングメールを起点としており、メール本文に記載されたGoogle Cloud Storageのリンクから、不正なファイルをダウンロードさせる手口が用いられていました。
SHELL_EXEC cmd.exe /c via ShellExecThread command: string
このデバイスインタフェースを利用する主な目的は、セキュリティ製品の無効化(0x22E010 IOCTL)と、自分自身のプロセスおよびネットワーク通信の隠蔽(0x22E008 IOCTL)です。
The malicious VERSION.dll decodes its own embedded strings with XOR 0x7a, then reads scheduler.cache, rolling-XOR-decodes it, manual-maps it into memory, and calls its entrypoint.
It registers services under the names "WinHealthSvc" and "Windows Diagnostics Service"... Writes the decrypted driver to disk as an EneTmp* named .sys. Creates and starts the service via SCM.
When dashost.exe runs, Windows loads the local VERSION.dll through standard DLL search-order hijacking.
Disables VulnerableDriverBlocklistEnable under SYSTEM\CurrentControlSet\Control\CI\Config (REG_DWORD 0).
その後、ファイル名と同じ名称でWindowsサービスとして登録し、このサービスを起動します。... 「DevCfgCC.sys」というファイル名で永続化ディレクトリへ書き出し、OSの起動時に自動的に読み込まれるよう、システムにサービスとして登録します。
It registers services under the names "WinHealthSvc" and "Windows Diagnostics Service", and adds a Run key entry.
The validly Microsoft-signed PoisonX driver is loaded into the Windows kernel.
...the Microsoft-signed PoisonX kernel driver to disable endpoint security through a BYOVD-style defense evasion technique before deploying the ransomware.
その後、ファイル名と同じ名称でWindowsサービスとして登録し、このサービスを起動します。... 「DevCfgCC.sys」というファイル名で永続化ディレクトリへ書き出し、OSの起動時に自動的に読み込まれるよう、システムにサービスとして登録します。
It registers services under the names "WinHealthSvc" and "Windows Diagnostics Service", and adds a Run key entry.
The validly Microsoft-signed PoisonX driver is loaded into the Windows kernel.
MITRE ATT&CK Perspective The observed behavior aligns with several MITRE ATT&CK techniques, including: ... Privilege Escalation
drop PoisonX, a malicious kernel driver which carries a legitimate Microsoft Windows Hardware Compatibility Publisher signature into the system driver store and is used to terminate security product processes
マルウェア内部にハードコードされている暗号化された10FXRAT関連ファイル...を、Incremental XORを用いて復号します。
StartPayload resolves APIs dynamically, initializes direct syscall helpers, binds Winsock, and loads any cached plugins from disk.
the attackers used an executable file disguised as a Symantec product to drop PoisonX
これを受け取ったドライバは、WindowsのカーネルAPIや、正規のネットワーク監視ドライバ(¥Driver¥nsiproxy、¥Device¥Tcpなど)をフックし、指定されたPIDのプロセス情報と通信記録をシステムから除外します。これにより、OSのプロセス一覧から自身の存在を消し去り、タスクマネージャーやEDR等の各種システム監視ツールから、プロセスおよびC2サーバとの不正な通信活動を隠蔽することが可能となります。
After decryption the plugin is loaded from memory as a reflective DLL and the decrypted copy is zeroed before freeing.
the signed host side-loads the attacker DLL, which decrypts the bundled cache to stage the driver and RAT.
or by attackers secretly exploiting legitimate third-party drivers.
Researchers observed the ransomware deploying a Microsoft-signed PoisonX driver before launching encryption.
System-wide and user-level mutexes (Global\SysMtx_51FB4B7B, Global\UsrMtx_EAB7CD0B) prevent multiple instances.
When dashost.exe runs, Windows loads the local VERSION.dll through standard DLL search-order hijacking.
After decryption the plugin is loaded from memory as a reflective DLL and the decrypted copy is zeroed before freeing.
Disables VulnerableDriverBlocklistEnable under SYSTEM\CurrentControlSet\Control\CI\Config (REG_DWORD 0).
PoisonX, a malicious kernel driver ... is used to terminate security product processes, further lowering the defenses of the system.
MITRE ATT&CK Perspective The observed behavior aligns with several MITRE ATT&CK techniques, including: OS Credential Dumping
GET_SERVICES EnumServicesStatus none
GET_STARTUP_ITEMS Startup enumeration none
GET_NET_CONNECTIONS GetExtendedTcpTable/UdpTable none
Defense Evasion GodDamn employs multiple techniques to avoid detection. These include: Kernel driver abuse Security process termination
GET_SYS_SUMMARY Host fingerprint none
System-wide and user-level mutexes (Global\SysMtx_51FB4B7B, Global\UsrMtx_EAB7CD0B) prevent multiple instances.
GET_SOFTWARE_LIST Installed software (Uninstall key) none
They installed AnyDesk for remote control and dropped it in a user’s Music folder.
A reusable installer script pushed the setup to at least 10 hosts.
Screen capture is built into core, not plugin-dependent. It uses GDI/GDI+ to capture the selected display as JPEG.
It is the command-and-control layer with a custom protocol over raw TCP.
SOCKS tunnelling is multiplexed over the existing RAT C2 connection... It calls getaddrinfo, creates a socket with a 10 second timeout, and connects directly from the infected host.
Encrypted plugins arrive as packet type 0x21 and are parsed by ParseAndLoadPayload
Researchers tagged a new ransomware strain, GodDamn, that runs the PoisonX kernel driver to kill endpoint defenses before it encrypts.
KILL_PROC TerminateProcess pid: number
58 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.