GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

Analysis of a recent GodDamn ransomware attack indicates that this seemingly new ransomware is in fact the latest rebrand of the Beast ransomware, which in itself was a rebrand of the Monster ransomware, which was first seen in 2022. The Symantec Threat Hunter Team tracks the developer behind these ransomware families as Hyadina.

The GodDamn ransomware, which our analysts found has significant code overlap with Beast, was documented as being first seen on May 21, 2026, with the attack we investigated taking place around two weeks later, in early June. During this atta…