Show Notes
Today we are joined by Brigid O Gorman, Senior Intelligence Analyst on Symantec Threat Hunter team, discussing their work on “GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses." GodDamn ransomware, the latest rebrand from the Hyadina group behind Monster and Beast, is using increasingly sophisticated techniques to evade defenses.
In a recent attack, the threat actors used AnyDesk for remote access, a broad credential-harvesting toolkit, and the PoisonX malicious kernel driver to disable endpoint security before deploying the ransomware. The activity highlights Hyadina’s continued development of its ransomware operations and an escalation in its defense-evasion capabilities.
The research and executive brief can be found here:
GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses
Learn more about your ad choices. Visit megaphone.fm/adchoices
More from CyberWire Daily
Amazon spots PHP exploits before disclosure. GitLab patches a critical flaw. Meta faces a $25 billion penalty. Autonomous AI agents power new cyberattacks. Hackers breach a Japanese cloud provider. CyberCartel unleashes AI against Latin American banks. Tor exit nodes are hijacked. OpenAI coding agents disable security monitoring. Interpol dismantles thousands of cybercrime networks across Africa. Our guest is Danny Manimbo, ISO and AI Practice Leader at Schellman, explaining why companies waiting for AI regulatory clarity may already be behind. Spotify hits the skip button on AI slop.
Critical PHP flaws threaten millions of websites. Weak certificates from an Indian authority spark a global security scramble. Investigators probe a U.S. consulting executive’s alleged ties to ShinyHunters. SafePay ransomware hits at least 600 critical infrastructure organizations. Researchers find troubling security biases in Chinese AI-generated code. A $10 million initiative bolsters cybersecurity for small U.S. utilities. An American pleads guilty to stealing from thousands of servicemembers and veterans. Leo Scott, Managing Director of DataTribe, is talking about their upcoming Cyber Innovation Conference and the 9th annual DataTribe Challenge. Two pallets of GPUs never make it to baggage claim.
A Google Cloud outage disrupts UK banks. DHS bans DeepSeek. Shape-shifting ransomware targets Macs. Bank of America hires an army to patch AI-discovered flaws. Canada looks to bypass the U.S. with a transatlantic cable. A contractor breach exposes California student data. Cybersecurity hiring slumps, but AI skills are booming. Researchers expose the Silent Ransom Group’s playbook. A suspected Qilin ransomware operator takes a vacation straight into custody. Our guest is Roman Arutyunov, Co-Founder of Xage Security, discussing the next era of Zero Trust. A hotel phishing scheme gets a chilly reception.
State election officials question CISA’s commitment to election security. Stolen credentials force ConnectWise to suspend cloud services. Fake calendar invites steal Microsoft logins. Temu settles Texas privacy allegations. Toronto police arrest seven in a cryptocurrency kidnapping case. The G7 sounds the alarm on quantum threats. Monday business briefing. Ben Yelin, sits down with Kevin Tian, CEO and Co-Founder of Doppel, to share how AI is changing the threat landscape for sports organizations. MapQuest puts surveillance on the map.
Through Executive Orders, the Trump administration is looking ensure that America's space capabilities have the workforce and technological innovation needed for success.