Kasseika Ransomware Using BYOVD Trick to Disarm Security Pre-Encryption

**Kasseika** ransomware uses a BYOVD approach—dropping a signed vulnerable driver (Martini.sys / viragt64.sys) and a helper executable (Martini.exe) to disable hundreds of security products, then deploys a ransomware payload (smartscreen_protected.exe) that encrypts files with ChaCha20 and RSA, clears Windows event logs, and demands a 50 BTC ransom with additional extortion; the report also notes ties to BlackMatter and briefly describes BianLian's extortion activity and tooling overlaps with other groups.