'GodDamn' Ransomware Uses BYOVD to Smite US Companies

A new ransomware strain dubbed "GodDamn" is leveraging a sophisticated attack vector to bypass security measures in US companies. The malware employs a Bring Your Own Vulnerable Driver (BYOVD) technique that exploits a Microsoft-signed kernel driver, creating significant challenges for cybersecurity professionals trying to defend against this emerging threat.

The attackers behind GodDamn ransomware have obtained a malicious kernel driver that was inadvertently signed by Microsoft through its driver signing program. This signed status allows the driver to be loaded onto systems without triggering typical security warnings. Once deployed, the driver terminates security processes, effectively disabling endpoint protection solutions before the ransomware encrypts files across the network. This co-signing incident represents a serious lapse in the driver verification ecosystem that threat actors are now exploiting to devastating effect.

US companies across various sectors are finding themselves in the crosshairs of this campaign. The ransomware appears to be selectively targeting organizations with valuable data and the financial capacity to pay substantial ransom demands. Early victims include businesses in manufacturing, technology, and professional services, indicating that the attackers are casting a wide net while potentially prioritizing organizations that cannot afford extended operational downtime.

The significance of this attack extends beyond the immediate encryption of files. By using a signed, trusted driver, the ransomware effectively neutralizes the security controls organizations have invested in, rendering traditional defense mechanisms ineffective. This approach represents an evolution in ransomware tactics, highlighting how threat actors continuously adapt their methods to circumvent emerging security technologies. The attack also exposes vulnerabilities in the software supply chain, particularly in the driver signing processes that many organizations implicitly trust.

Security teams must immediately reass