Reynolds Ransomware — Ransomware Profile

Reynolds is a ransomware group first identified in February 2026, notable for embedding a Bring Your Own Vulnerable Driver (BYOVD) defense evasion component directly within its ransomware payload — rather than deploying a separate EDR killer as a prior stage. The payload drops the NsecSoft NSecKrnl kernel-mode driver (CVE-2025-68947) to terminate processes belonging to CrowdStrike Falcon, Palo Alto Cortex XDR, Sophos, Symantec Endpoint Protection, and Avast before initiating encryption. Reynolds was initially misattributed to Black Basta by Broadcom due to tactical similarities; further analysis by the Symantec and Carbon Black Threat Hunter Team confirmed it as a distinct new family. Observed intrusions feature extended dwell time via a side-loaded loader deployed weeks before the ransomware, followed by GotoHTTP deployment post-encryption for persistent access.

IntelFusions coverage (1)

Reynolds Ransomware Bundles BYOVD Defense Evasion Directly Into Payload — A Rare and Dangerous Evolution 2026-02-05 · Ransomware

Tools & malware

GotoHTTP remote_access
NSecKrnl.sys (NsecSoft NSecKrnl Driver) vulnerable_driver
Reynolds Ransomware Payload ransomware

Vendor research

Reynolds Ransomware: BYOVD Evasion & NSecKrnl Abuse Brandefense
Reynolds ransomware uses BYOVD to disable security before encryption Security Affairs
Reynolds Bundles BYOVD With Ransomware Payload Dark Reading
Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools The Hacker News
Reynolds: Defense Evasion Capability Embedded in Ransomware Payload Broadcom / Symantec

Read the full analysis on IntelFusions