BYOVD Attacks Help Ransomware Gangs Bypass Endpoint Defenses

The report describes a 2026 ransomware evolution where threat actors use BYOVD techniques and signed vulnerable drivers to disable EDRs, adopt post‑quantum encryption (e.g., Kyber1024 in a PE32 family), and shift toward data theft and encryptionless extortion; it highlights major financial impact (estimated $18B loss in manufacturing) and identifies dominant groups and new affiliates such as Qilin and The Gentlemen.