--- title: How the GodDamn Ransomware Driver Bypasses Your EDR description: GodDamn ransomware (also known as Beast and Monster) uses a kernel driver called PoisonX — carrying a genuine Microsoft Windows Hardware Compatibility... canonical: https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How the GodDamn Ransomware Driver Bypasses Your EDR | daily.dev og:description: GodDamn ransomware (also known as Beast and Monster) uses a kernel driver called PoisonX — carrying a genuine Microsoft Windows Hardware Compatibility... og:url: https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu og:image: https://api.daily.dev/og/posts/6ruyzZ7fU.png og:image:alt: How the GodDamn Ransomware Driver Bypasses Your EDR og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How the GodDamn Ransomware Driver Bypasses Your EDR **[Latest Hacking News](https://daily.dev/sources/lhn)** · 5 min read · 0 upvotes · 0 comments ## Summary GodDamn ransomware (also known as Beast and Monster) uses a kernel driver called PoisonX — carrying a genuine Microsoft Windows Hardware Compatibility Publisher signature — to disable EDR agents via a bring-your-own-vulnerable-driver (BYOVD) technique. Once loaded with kernel privileges, PoisonX terminates security processes and strips API hooks, effectively blinding endpoint protection. The attack chain also involves AnyDesk for remote access, PsExec for lateral movement, and Mimikatz plus NirSoft tools for credential harvesting across at least ten hosts. Three mitigations are recommended: enabling HVCI and the vulnerable driver blocklist, activating the Defender ASR rule that blocks writing vulnerable signed drivers to disk, and manually applying the latest Microsoft blocklist via App Control for Business. Behavioural detection — monitoring driver load events in the CodeIntegrity log, watching for unusual remote-access tool placement, and restricting local admin rights — is essential since new malicious signed drivers won't appear on blocklists immediately. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Black Basta Bundles BYOVD With Ransomware Payload](https://daily.dev/posts/black-basta-bundles-byovd-with-ransomware-payload-xkktwsdyu) · Dark Reading · 1 upvotes · 0 comments - [Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform](https://daily.dev/posts/threat-actor-adds-advanced-edr-killer-tools-to-ransomware-as-a-service-platform-vgthonbtl) · CSO Online · 0 upvotes · 0 comments - [Microsoft Under Pressure to Bolster Defenses for BYOVD Attacks](https://daily.dev/posts/microsoft-under-pressure-to-bolster-defenses-for-byovd-attacks-98f7gahm1) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How the GodDamn Ransomware Driver Bypasses Your EDR","url":"https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu"},"datePublished":"2026-07-10T16:21:57.702Z","dateModified":"2026-07-10T16:22:19.040Z","description":"GodDamn ransomware (also known as Beast and Monster) uses a kernel driver called PoisonX — carrying a genuine Microsoft Windows Hardware Compatibility...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a7ded0146db9c3eaf5295cd829ebcd96?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a7ded0146db9c3eaf5295cd829ebcd96?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Latest Hacking News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Latest Hacking News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5110318ded6e43f1bb12facdeb2b1965","url":"https://daily.dev/sources/lhn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Latest Hacking News","item":"https://daily.dev/sources/lhn"},{"@type":"ListItem","position":3,"name":"How the GodDamn Ransomware Driver Bypasses Your EDR"}]} ```