Reynolds Ransomware Embeds BYOVD Driver to Evade Defences

Du'aine Davis

Observed in the wild

• A recent campaign using the emergent Reynolds ransomware family targeted organisations in early February 2026. The ransomware embedded a Bring‑Your‑Own‑Vulnerable‑Driver (BYOVD) component directly within its payload, uncommon among modern ransomware. Victim environments showed weeks‑long dwell time indicators, including a suspicious side‑loaded loader and later installations of GotoHTTP, suggesting persistence attempts even post‑encryption.
• The ransomware drops and loads a vulnerable NsecSoft NSecKrnl driver (CVE‑2025‑68947), using it to kill security processes from vendors including Sophos, Symantec, CrowdStrike, ESET, Avast and Microsoft Defender (MsMpEng). It appends “.locked” to encrypted files. The BYOVD inclusion enables kernel‑level termination of protected processes and accelerates the attack by eliminating the need for separate tooling.
• Organisations are advised to monitor for unsigned or suspiciously‑deployed drivers, unexpected service creation (especially NSecKrnl), and kernel‑level IOCTL activity targeting AV/EDR processes. Microsoft Defender customers should configure Attack Surface Reduction, enable kernel-mode driver blocklisting, and track attempts to disable or terminate MsMpEng.

NVD - CVE-2025-68947
Reynolds: Defense Evasion Capability Embedded in Ransomware Payload | SECURITY.COM