MalwareUsed by 1 actor

GodDamn ransomware

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Hyadina

GodDamn ransomware looks new, but it is not. Symantec says it is “the latest rebrand of the Beast ransomware,” itself a rebrand of Monster from 2022.

via security online infosecurityonline.info

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

Researchers said it is unknown how the attackers gained initial access to the machine prior to this, but account compromise is a common starting point for ransomware attacks.

Persistence

2 techniques

T1078Valid AccountsEvidence1

Researchers said it is unknown how the attackers gained initial access to the machine prior to this, but account compromise is a common starting point for ransomware attacks.

T1543.003Windows ServiceEvidence1

They then installed AnyDesk for unattended access on each host, suppressed its consent prompt, and added auto-start services for persistence.

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

Researchers said it is unknown how the attackers gained initial access to the machine prior to this, but account compromise is a common starting point for ransomware attacks.

T1543.003Windows ServiceEvidence1

They then installed AnyDesk for unattended access on each host, suppressed its consent prompt, and added auto-start services for persistence.

Stealth

2 techniques

T1036MasqueradingEvidence1

the attackers used an executable file disguised as a Symantec product to drop PoisonX

T1078Valid AccountsEvidence1

Researchers said it is unknown how the attackers gained initial access to the machine prior to this, but account compromise is a common starting point for ransomware attacks.

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

the attackers installed tools including NirSoft and Mimikatz, which are used to steal credentials, cookies, live network traffic and more, with the aim of finding means to gain further control over the machine and the wider network, including administrator accounts.

Lateral Movement

3 techniques

T1021Remote ServicesEvidence2

Symantec researchers said the attackers were spotted leveraging AnyDesk, a remote desktop application, which was hidden on the affected endpoint in a folder named ‘Music’ and made outbound connections to unknown IP addresses.

T1021.002SMB/Windows Admin SharesEvidence1

The operators disabled Windows Defender real-time monitoring and mounted admin shares with stolen credentials.

T1570Lateral Tool TransferEvidence1

A reusable installer script pushed the setup to at least 10 hosts.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

Finally, when enough control over accounts and systems had been gained, the attackers triggered GodDamn ransomware, encrypting the files and displaying a ransom note.

Other

1 technique

T1562Impair DefensesEvidence2

PoisonX, a malicious kernel driver ... is used to terminate security product processes, further lowering the defenses of the system.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

security online infoNews

Jul 15, 2026

GodDamn Ransomware Is a Beast Rebrand That Kills EDR

A ransomware family operated by Hyadina that encrypts files on enterprise Windows networks. It is described as the latest rebrand of Beast/Monster and is deployed after hands-on intrusion, using PoisonX to disable endpoint defenses, credential theft tooling, PsExec for lateral movement, and AnyDesk for persistence and remote access.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

GodDamn ransomware

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Hyadina

GodDamn ransomware looks new, but it is not. Symantec says it is “the latest rebrand of the Beast ransomware,” itself a rebrand of Monster from 2022.

via security online infosecurityonline.info

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

Researchers said it is unknown how the attackers gained initial access to the machine prior to this, but account compromise is a common starting point for ransomware attacks.

Persistence

2 techniques

T1078Valid AccountsEvidence1

Researchers said it is unknown how the attackers gained initial access to the machine prior to this, but account compromise is a common starting point for ransomware attacks.

T1543.003Windows ServiceEvidence1

They then installed AnyDesk for unattended access on each host, suppressed its consent prompt, and added auto-start services for persistence.

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

Researchers said it is unknown how the attackers gained initial access to the machine prior to this, but account compromise is a common starting point for ransomware attacks.

T1543.003Windows ServiceEvidence1

They then installed AnyDesk for unattended access on each host, suppressed its consent prompt, and added auto-start services for persistence.

Stealth

2 techniques

T1036MasqueradingEvidence1

the attackers used an executable file disguised as a Symantec product to drop PoisonX

T1078Valid AccountsEvidence1

Researchers said it is unknown how the attackers gained initial access to the machine prior to this, but account compromise is a common starting point for ransomware attacks.

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

Lateral Movement

3 techniques

T1021Remote ServicesEvidence2

T1021.002SMB/Windows Admin SharesEvidence1

The operators disabled Windows Defender real-time monitoring and mounted admin shares with stolen credentials.

T1570Lateral Tool TransferEvidence1

A reusable installer script pushed the setup to at least 10 hosts.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

Finally, when enough control over accounts and systems had been gained, the attackers triggered GodDamn ransomware, encrypting the files and displaying a ransom note.

Other

1 technique

T1562Impair DefensesEvidence2

PoisonX, a malicious kernel driver ... is used to terminate security product processes, further lowering the defenses of the system.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

security online infoNews

Jul 15, 2026

GodDamn Ransomware Is a Beast Rebrand That Kills EDR

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.