CVE-2025-68947

BYOVD Example: CVE-2025-68947 Even CVSS Medium vulnerabilities can enable powerful attack chains. Risk assessments must consider operational impact and adversary capabilities, not just scores. https://t.co/ZLJ1CduWBA

A new ransomware group called Reynolds is leveraging BYOVD (Bring Your Own Vulnerable Driver) to disable EDR/AV before encryption. They’re abusing the NSecKrnl driver (CVE-2025-68947) to reduce visibility at the kernel level. If you’re not monitoring vulnerable drivers and h

Reynolds Ransomware doesn’t just encrypt files. It disables defenses at the kernel level first. Our Threat Research team analyzed its BYOVD abuse of NSecKrnl.sys (CVE-2025-68947), AV/EDR termination via IOCTL, multi-threaded encryption & qTox comms. https://t.co/dChzUlummV

Reynolds Ransomware: BYOVD Abuse of NSecKrnl.sys (CVE-2025-68947) for Kernel-Level Defense Evasion https://t.co/4TfRX6nN7E Introduction: Reynolds Ransomware employs a Bring Your Own Vulnerable Driver (BYOVD) strategy to disable endpoint defenses before initiating encryption.

Happy to share my writeup for the challenge 'Kernel Shield' on https://t.co/VjZa958DNA, created by @MalGamy12. In this challenge we are tasked to analyze a benign kernel driver file, which can be exploited to kill specific processes (CVE-2025-68947). https://t.co/xNaoz9A1kO

🚨 New Challenge: Kernel Shield Reverse engineer the NSecKrnl driver (CVE-2025-68947). weaponized in the #Reynolds ransomware BYOVD campaign to kill EDR/AV processes. challenge: https://t.co/7ANwUH5j5J discord: https://t.co/oBPe6oItWX https://t.co/P8ov6OFYTZ

🚨 New Challenge: Kernel Shield Reverse engineer the NSecKrnl driver (CVE-2025-68947). weaponized in the #Reynolds ransomware BYOVD campaign to kill EDR/AV processes. 🔗 https://t.co/2Cob78hObV 🔗 https://t.co/hZlNYL9AFK https://t.co/9wxwdIRwJw

🚨 Reynolds Ransomware Goes BYOVD: Driver Exploit to Kill EDR Before Encryption New “Reynolds” ransomware is using a Bring Your Own Vulnerable Driver (BYOVD) approach—abusing the NsecSoft NSecKrnl driver tied to CVE-2025-68947—to escalate privileges and terminate securi

🚨 Reynolds Ransomware Bundles BYOVD Driver to Kill EDR Before Encrypting Reynolds is a newly identified ransomware that embeds a vulnerable signed NsecSoft kernel driver (NSecKrnl) and exploits CVE-2025-68947 to terminate major security/EDR processes (Defender, CrowdStrike,

🚨 Reynolds Ransomware Packs BYOVD Driver to Kill EDR Before Encryption A new ransomware strain dubbed Reynolds bundles a vulnerable signed driver (NsecSoft NSecKrnl, CVE-2025-68947) inside the payload to terminate EDR/AV processes (e.g., CrowdStrike, Cortex XDR, Sophos,

Evolución táctica: Reynolds usa CVE-2025-68947 y BYOVD para anular Sophos, ESET, Defender y CrowdStrike desde el kernel. El payload deshabilita defensas antes del cifrado. IOCs (SHA-256) detallados en las imágenes. #Infosec #Reynolds #BYOVD #Cybersecurity #Fenikso https://t.

⚠️🛠️ Reynolds ransomware embeds its own BYOVD evasion, bundling a vulnerable driver to disable EDR before encryption. It drops the NSecKrnl driver (CVE-2025-68947) to kill security tools, reducing detection and affiliate effort. 🔗 Read full attack chain and defense

🚨 Black Basta Levels Up: BYOVD Driver Embedded Directly Inside Ransomware Payload A new Black Basta campaign embeds a “Bring Your Own Vulnerable Driver” (BYOVD) component directly into the ransomware, dropping the signed NsecSoft NSecKrnl driver and abusing CVE-2025-68947

Black Basta ransomware uses a vulnerable signed kernel driver (CVE-2025-68947) embedded in its payload to kill security processes and evade defenses, appending “.locked” to encrypted files. Includes GotoHTTP RAT for persistence. #BlackBasta #RansomwareEv… https://t.co/eHK8d

The ransomware payload drops a vulnerable NsecSoft NSecKrnl driver and tries to create an NSecKrnl service. This driver is then exploited to kill processes. The NSecKrnl driver is a Windows kernel-mode driver with a known critical security vulnerability (CVE-2025-68947), which h

🚨 Black Basta embeds BYOVD inside ransomware payload to kill EDR at kernel level Symantec/Carbon Black report Black Basta bundling a vulnerable signed driver (NsecSoft NSecKrnl, CVE-2025-68947) directly inside the ransomware, dropping it as a service and abusing IOCTLs to

CVE-2025-68947 NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Proces… https://t.co/EFxEy25ieG

🚨 Kernel Panic: How a Single IOCTL Bug (#CVE-2025-68947) Lets Hackers Kill Any Process on Your Machine https://t.co/8Y76sEj183 Educational Purposes!