GodDamn Ransomware Uses PoisonX Driver and Credential Harvesting to Bypass Endpoint Defenses

GodDamn ransomware was first publicly observed in the wild on May 21, 2026 and is assessed as a rebrand of Beast, which is an enhanced version of Monster, a Delphi-based ransomware that appeared in March 2022.

In an early June 2026 attack, attackers used AnyDesk for remote access and a NirSoft-based credential harvesting toolkit to extract data from browsers, Windows Credential Manager, cached domain credentials.

GodDamn ransomware uses the PoisonX signed kernel driver and credential harvesting plus AnyDesk access to disable defenses and encrypt systems.