GodDamn Ransomware Deploys Signed PoisonX Driver to Blind Security Tools
What Happened – Symantec’s Threat Hunter team identified a new ransomware family, GodDamn, that uses a malicious, Microsoft‑signed kernel driver called PoisonX. The driver runs at kernel level and disables or blinds endpoint security products, effectively rendering them blind to the ransomware’s activity.
Why It Matters for Compliance & Audit Readiness
- The technique bypasses the “Security Monitoring” control (SOC 2 CC6.1) by subverting trusted drivers, highlighting the need for continuous evidence that security tools remain operational.
- Demonstrates a control‑gap scenario where a signed driver can be abused, underscoring the value of mapping such gaps to SOC 2 requirements and collecting audit‑ready proof of driver‑validation processes.
Who Is Affected – Primarily enterprises that rely on Windows‑based endpoints, across technology, financial services, and other sectors that must meet SOC 2 compliance.
Recommended Actions
- Map the driver‑validation and kernel‑integrity controls to your SOC 2 audit framework.
- Deploy continuous monitoring solutions that verify the health and signature status of all kernel drivers.
- Incorporate driver‑integrity checks into your evidence‑collection pipeline for audit readiness.
- Update security awareness training to include BYOVD attack vectors.
Source: Security Affairs
Technical Notes – PoisonX is a malicious kernel driver with a valid Microsoft signature, enabling it to be auto‑loaded by Windows. It can terminate security‑software processes, strip required permissions, or tamper with kernel event notifications. The technique is a variant of a Bring‑Your‑Own‑Vulnerable‑Driver (BYOVD) attack. Source: same as above