Recent Black Basta Ransomware Campaign Embeds Vulnerable Driver in Payload

Back Broadcom

Recent Black Basta Ransomware Campaign Embeds Vulnerable Driver in Payload

Broadcom • February 5, 2026

Share: View original

Hacktool.Webshell · Ransom.Basta · Trojan Horse · Trojan.Gen.MBT · WS. Malware .1.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Black Basta Ransomware Integrates BYOVD Defense Evasion Technique The Black Basta ransomware gang has incorporated a bring-your-own-vulnerable-driver (BYOVD) defense evasion component within its ransomware payload. This technique, which typically involves separate tools to disable security software, was notably embedded in the ransomware itself during recent attacks. The vulnerable driver identified is the NsecSoft NSecKrnl driver, which poses risks to affected systems. 9 sources 51

Extracted Entities

Attack Types (1)

Campaigns (1)

Black Basta Ransomware Campaign

Malware (1)

MITRE ATT&CK (3)

T1068 - Exploitation for Privilege Escalation T1486 - Data Encrypted for Impact T1505.003 - Web Shell

Ransomware Groups (2)

Black Basta Ransom.Basta

Tools (1)

Hacktool.Webshell