Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools

**Reynolds ransomware** has been observed bundling a vulnerable, signed driver (NsecSoft NSecKrnl, CVE-2025-68947) inside the ransomware payload to perform BYOVD-based defense evasion—killing processes of major EDR/AV products—while ancillary activity (a side‑loaded loader and the GotoHTTP RAT) suggests pre-deployment footholds and persistence; the report situates this campaign within a wider uptick in professionalized, high-impact ransomware operations across 2025.