As I understand it, there are two different issues, copyright in the derivative work, and legality of the act of creating the derivative work.

Copyright of a derivative work that itself meets the standard for copyrightability rests with the creator of the derivative, because, under law, any copyrightable work has a copyright that belongs to the creator at the moment it is created.

A derivative created without proper permission is also a violation of the copyright of the original, but that's a separate issue.