Executive Summary
REYNOLDS is a sophisticated ransomware operation that surfaced in late 2025, specifically targeting enterprise environments through a mature attack chain. The group employs a unique kernel-mode driver, NSecKrnl, to achieve high-privilege termination of security software (Ring 0 process killing), effectively bypassing major EDR and AV solutions such as CrowdStrike, Sophos, and ESET.
Technically, the malware demonstrates advanced tradecraft, including ntdll loader hijacking for deep process injection and the abuse of the Windows Restart Manager API to unlock files held by active processes. The group follows a double-extortion model, maintaining a Tor-based leak site and utilizing the encrypted p2p messenger qTox for victim negotiations. A confirmed attack on Falcon Management Corp in November 2025 underscores the immediate threat posed by this actor to financial and investment advisory sectors.