Silent Killer: Black Basta Bundles “BYOVD” Driver to Blind Antivirus

Black Basta (aka Cardinal) has started bundling a vulnerable signed Windows kernel driver (NsecSoft NSecKrnl, CVE-2025-68947) directly into its ransomware payload (a BYOVD technique) to terminate security processes and enable quieter, faster encryption campaigns—making attacks harder to detect and easier for low-skilled affiliates to execute.