Darkreading Black Basta Ransomware Integrates BYOVD Defense Evasion Technique
Article Content
Browse articles 
The Black Basta ransomware gang has incorporated a bring-your-own-vulnerable-driver (BYOVD) defense evasion component within its ransomware payload. This technique, which typically involves separate tools to disable security software, was notably embedded in the ransomware itself during recent attacks. The vulnerable driver identified is the NsecSoft NSecKrnl driver, which poses risks to affected systems.
Ask AI about this cluster
Answers cite the sources they use
Updated 228d ago How this analysis works
Timeline
2026-01-13
CVE-2025-68947 published
2026-02-05
Black Basta attack campaign with BYOVD reported
2026-02-09
Research on Black Basta's ransomware with embedded driver published
More articles in this cluster (9)
Following this threat?
Track Black Basta and CVE-2025-68947 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Emerging EDR Killer Tool Targeting Ransomware Groups A new malicious tool, referred to as the EDR killer, is being actively used by at least eight ransomware groups, including Blacksuit and Medusa, to disable endpoint detection and response (EDR) solutions. This tool is believed to be an evolution of the EDRKillShifter developed by RansomHub, which allows ransomware… 
Phishing Attacks Exploit Microsoft Teams for Credential Theft In 2026, attackers increasingly impersonated IT support via Microsoft Teams to steal credentials and spread malware. Ontinue's report noted that 30% of monitored organizations experienced such impersonation attempts, with one in every 990 external contacts showing signs of fraud. The Shai-Hulud npm worm was identified…