GodDamn Ransomware Uses Malicious Signed Driver (PoisonX) to Disable Endpoint Defenses
What Happened — Researchers observed a ransomware campaign dubbed “GodDamn” that is a re‑brand of the Beast/Monster families. The attackers leveraged a malicious, Microsoft‑signed kernel driver (PoisonX) to shut down endpoint security services, deployed a fake Symantec executable, and used AnyDesk for remote access before encrypting files.
Why It Matters for Compliance & Audit Readiness
- The attack demonstrates a control gap: reliance on a single endpoint‑security control that can be bypassed at the kernel level.
- SOC 2 + continuous‑compliance programs must map such defense‑evasion techniques to the System Security (CC6.1) and Change Management (CC7.1) criteria and retain evidence that controls are operating as intended.
- Verisq’s Control Mapping capability can automatically correlate this driver‑based evasion to the relevant SOC 2 controls and provide continuous audit evidence of remediation.
Who Is Affected — Enterprises across all verticals that run Windows endpoints with third‑party security agents; particularly organizations with limited driver‑whitelisting or insufficient kernel‑mode monitoring.
Recommended Actions
- Verify that only trusted, digitally‑signed drivers are allowed to load; enforce strict driver signing policies (e.g., Windows Code Integrity).
- Augment endpoint detection with kernel‑level behavior analytics that can flag unauthorized IOCTL calls.
- Document the control mapping to SOC 2 CC6.1 and CC7.1, capture logs as audit evidence, and test the remediation in a change‑management workflow.
Technical Notes — Attack chain: unknown initial foothold → AnyDesk placed in csidl_profile\music\anydesk.exe → outbound connections to AnyDesk relays → deployment of symantec.exe (fake Symantec product) → loading of PoisonX driver (signed by Microsoft) to kill CrowdStrike Falcon and other agents → ransomware encryption (files renamed with victim‑specific extension). Source: Broadcom Symantec Blog