Ransomware Used Microsoft-Signed Malicious Driver to Kill EDR: 10 Hosts Hit Before Encryption

Ransomware EDR killers just leveled up: GodDamn ransomware used PoisonX — a kernel driver bearing a legitimate Microsoft Hardware Compatibility Publisher signature — to terminate security software on

The GodDamn ransomware operation has been active for four years, with its latest attack utilizing a Microsoft-signed kernel driver called PoisonX to destroy endpoint security software. This driver bears a legitimate Microsoft Hardware Compatibility Publisher signature, which allowed it to evade detection. The attack affected 10 hosts before encryption, with the ransomware operation demanding payment in exchange for the decryption key. The use of a legitimate Microsoft signature is a significant escalation in ransomware tactics.

This development directly affects companies that rely on Microsoft-based security solutions, as the use of a legitimate Microsoft signature can bypass traditional security measures. For example, businesses that use Microsoft Defender may be at risk of having their security software terminated by the PoisonX driver. This can result in significant financial losses, as companies may be forced to pay the ransom to restore access to their data. The cost of such an attack can be substantial, with some estimates suggesting that the average cost of a ransomware attack is over $1 million.

The GodDamn ransomware operation is part of a larger trend of increasingly sophisticated ransomware attacks. In recent years, ransomware groups have begun to use more advanced tactics, such as exploiting zero-day vulnerabilities and using legitimate software signatures to evade detection. This shift towards more sophisticated attacks has been driven in part by the increasing profitability of ransomware, with some groups earning millions of dollars in ransom payments. Insiders know that the use of legitimate software signatures is a particularly concerning development, as it suggests that ransomware groups have gained significant expertise and resources.

In the coming weeks, Microsoft is expected to release a patch to prevent the use of legitimate signatures to bypass security measures. The patch is scheduled to be released on the next Patch Tuesday, which is typically the second Tuesday of the month. Meanwhile, security researchers are warning companies to be on the lookout for similar attacks, as the GodDamn ransomware operation is likely not the only group to have developed this tactic. Interestingly, the use of legitimate Microsoft signatures by ransomware groups may actually be a sign of the effectiveness of traditional security measures, as groups are being forced to resort to more complex and expensive tactics to evade detection.