Black Basta Ransomware Actors Embeds BYOVD Defense Evasion Component with Ransomware Payload Itself

Black Basta has shifted tactics by embedding a vulnerable signed kernel driver (NsecSoft NSecKrnl, CVE-2025-68947) inside its ransomware payload to obtain kernel privileges, kill security/EDR processes (e.g., SophosHealth.exe, MsMpEng.exe), and encrypt files with a .locked extension; Symantec attributes the behavior to activity linked with the Cardinal cybercrime group and notes prior side-loaded loaders—organizations should consult Symantec’s protection bulletin for IOCs and mitigation guidance.