A ransomware campaign analyzed by Symantec Threat Intelligence has highlighted an unusual evolution in ransomware tradecraft: the Reynolds ransomware family embeds its Bring Your Own Vulnerable Driver (BYOVD) defense evasion component directly inside the ransomware payload itself, rather than deploying it as a separate pre-attack tool. Initially misattributed to Black Basta based on TTP similarities, subsequent analysis confirmed Reynolds as an emergent ransomware family. The technique, previously seen only in a 2020 Ryuk attack and a 2025 Obscura campaign, significantly compresses the attack timeline and eliminates a key defender intervention window.
The BYOVD-in-Payload Technique
In conventional ransomware attacks, defense impairment is a distinct phase: a signed vulnerable driver is deployed to disable endpoint detection and response (EDR) or antivirus software before the ransomware payload is staged separately. Each step creates a detection opportunity. Reynolds collapses this into a single action — the payload drops and loads a vulnerable NsecSoft NSecKrnl driver, exploiting CVE-2025-68947, a critical vulnerability that allows any local authenticated user to terminate processes owned by other users, including SYSTEM-level and Protected Processes, via crafted IOCTL requests. Files encrypted by Reynolds receive the .locked extension.
The NSecKrnl driver's kernel-mode access enables termination of security software processes before the encryption phase begins. By bundling this capability within the payload, Reynolds eliminates the gap defenders could use to detect and interrupt the attack between driver staging and ransomware execution.
Pre-Deployment Activity and Unusual Post-Encryption Presence
Investigators identified a suspicious side-loaded loader on the target network several weeks before ransomware deployment, suggesting a lengthy dwell time — though the link to the ransomware activity could not be confirmed. More unusually, the GotoHTTP remote access tool appeared on some machines the day after ransomware deployment. Post-encryption attacker activity is rare and may indicate an attempt to maintain persistent access to the environment, potentially for double-extortion leverage or follow-on operations.
BYOVD: The Dominant Defense Evasion Technique in 2026
BYOVD has become the most prevalent defense impairment technique across ransomware operations, driven by its effectiveness and the legitimacy signal provided by signed binaries. Commonly exploited tools in the ecosystem include TrueSightKiller (truesight.sys), GhostDriver, AuKill (leveraging a Process Explorer driver), Warp AVKiller (using a vulnerable Avira anti-rootkit driver), and Poortry/BurntCigar — a malicious driver that Sophos assesses was developed by attackers who obtained a legitimate signature. Living-off-the-land techniques targeting Windows Defender also remain in use but are secondary to BYOVD in prevalence. The use of defense impairment techniques has risen markedly over the past two years, most likely in response to improved vendor detection of pre-ransomware activity patterns.
Strategic Implications for Ransomware Development
The Reynolds technique offers ransomware-as-a-service operators a potential affiliate attraction argument: a payload requiring fewer manual steps, producing less detectable pre-encryption noise, and compressing the attack timeline into a single detonation event. If the bundled approach proves operationally successful, it may drive broader adoption among ransomware families competing for affiliates — making the question of whether more groups follow Reynolds's lead one of the more consequential near-term developments in ransomware tradecraft to watch.