Ransomware Gangs Use BYOVD and EDR Killers to Disable Security Tools

Ransomware has become more targeted and sophisticated in 2025–2026: attackers are using EDR-killers and Bring Your Own Vulnerable Driver (BYOVD) techniques to neutralize security controls, trading initial access via IABs, and increasingly focusing on data theft and extortion rather than encryption. Notable trends include the emergence of post-quantum cryptography in ransomware (e.g., Kyber1024/ML-KEM), the dominance of groups like Qilin, and significant economic impact (estimated $18B losses in manufacturing in early 2025), while law enforcement actions have disrupted some platforms but new services quickly appear.