New Ransomware GodDamn Uses PoisonX Driver

Cybersecurity researchers have identified a new ransomware family named GodDamn, which employs the PoisonX kernel driver to disable security software. According to a report from Symantec's Threat Hunter Team, the ransomware was first spotted in the wild on May 21, 2026. This malware is considered a rebranding of the already known Beast ransomware. The use of the PoisonX driver allows GodDamn to circumvent security measures that typically prevent access to critical system resources.

This technique poses a serious threat to businesses, as it significantly reduces the effectiveness of antivirus and endpoint protection solutions. Researchers warn that the ransomware specifically targets vulnerabilities in the security infrastructure of companies. Symantec has found that GodDamn not only disables security software but also encrypts data and demands ransom. The attackers employ sophisticated techniques to cover their tracks and make detection by security analysts more difficult. The ransomware could spread rapidly, as it is capable of adapting to various environments.

The threat posed by GodDamn is rated as high, particularly in industries that rely on sensitive data. Companies lacking robust security measures are especially vulnerable. Researchers recommend conducting regular security audits and ensuring that all systems are up to date to fend off potential attacks. The ransomware has already affected several companies worldwide, leading to significant financial losses. The exact number of impacted systems is currently unknown; however, it is estimated that attacks could increase in the coming weeks.

Security researchers are working to halt the spread of the malware and develop appropriate countermeasures. Symantec has also pointed out that the attackers behind GodDamn may possess extensive resources and expertise. The complexity of the malware and the techniques used suggest that it is the work of a well-organized group. The security community is alarmed and mobilizing its forces to combat the threat. The discovery of GodDamn comes at a time when cyberattacks are increasing globally.

According to the Cybersecurity & Infrastructure Security Agency (CISA), there was a 30% increase in ransomware attacks in 2025 compared to the previous year. This trend underscores the urgency of strengthening security measures and responding to new threats. Security researchers advise companies to educate their employees about the risks of ransomware and provide training on recognizing phishing attempts. A proactive approach can help reduce the likelihood of a successful attack. The implementation of multi-factor authentication procedures is also recommended to prevent unauthorized access.

The Symantec study emphasizes that the threat posed by GodDamn should not be ignored. Companies are urged to reconsider and adjust their security strategies as necessary. Researchers stress that a swift response to security incidents is crucial to minimize damage and facilitate recovery. The vulnerability exploited by GodDamn could lead to further attacks in the coming months if companies do not respond appropriately. Researchers are working on developing decryption tools to assist affected companies in recovering their data.

However, there is currently no guarantee that these tools will be successful. The threat posed by GodDamn remains a central issue in the cybersecurity community. Symantec researchers plan to deepen their findings in the coming weeks and regularly publish updates to inform the public about new developments. The vulnerability CVE-2026-1234 reportedly affects around 50,000 systems in Germany, according to the BSI.