‘GodDamn’ Ransomware Leverages Malicious Signed Driver to Disable Security Software in US Companies
What Happened — The “GodDamn” ransomware family is using a BYOVD (Bring‑Your‑Own‑Vulnerable‑Driver) technique that loads a malicious kernel driver signed by Microsoft. The driver disables endpoint‑security tools, allowing the ransomware to encrypt data and demand payment.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how a signed driver can subvert the “protective” controls that SOC 2 expects organizations to enforce (CC6.1 – logical access, CC7.1 – monitoring).
- Highlights the need for continuous evidence that only approved, vetted drivers are allowed to load on production systems.
- Shows the importance of security‑awareness training that educates staff on the risks of BYOVD and other low‑level evasion tactics.
Who Is Affected – Primarily U.S. enterprises across finance, healthcare, technology, and manufacturing that run Windows‑based workloads.
Recommended Actions
- Map the incident to SOC 2 CC6.1 (Logical Access) and CC7.1 (System Monitoring) controls; collect logs showing driver‑loading events as audit evidence.
- Enforce a strict driver‑allowlist policy and disable unsigned driver loading via Group Policy or Microsoft Defender Application Control.
- Augment security‑awareness curricula with a module on BYOVD and kernel‑level threats.
- Deploy endpoint detection that can flag anomalous driver signatures and generate continuous compliance evidence.
Source: Dark Reading – GodDamn Ransomware Uses BYOVD to Smite US Companies
Technical Notes – The attack leverages a Microsoft‑signed kernel driver (no CVE disclosed) to bypass security software, a classic BYOVD technique. Data encrypted includes files on local disks and network shares; no public exfiltration details were released.