Back Cybersecuritynews

Black Basta Ransomware Actors Embeds BYOVD Defense Evasion Component with Ransomware Payload Itself

Cybersecuritynews •Tushar Subhra Dutta • February 9, 2026

Ransomware actors are constantly refining their arsenals to bypass modern defenses. A recent campaign by the Black Basta group has introduced a significant tactical shift by embedding a “Bring Your Own Vulnerable Driver” (BYOVD) component directly into the ransomware payload itself. This integration marks a notable departure from standard operating procedures, where defense evasion tools […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Black Basta Ransomware Integrates BYOVD Defense Evasion Technique The Black Basta ransomware gang has incorporated a bring-your-own-vulnerable-driver (BYOVD) defense evasion component within its ransomware payload. This technique, which typically involves separate tools to disable security software, was notably embedded in the ransomware itself during recent attacks. The vulnerable driver identified is the NsecSoft NSecKrnl driver, which poses risks to affected systems. 9 sources 51

Extracted Entities

Black Basta Ransomware Actors Embeds BYOVD Defense Evasion Component with Ransomware Payload Itself

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Ransomware Groups (1)