InfoSecBulletin Cybersecurity for mankind
The BlackByte ransomware group is suspected of using a recently fixed security issue in VMware ESXi hypervisors. They are also taking advantage of weak drivers to bypass security measures.
A vulnerability named CVE-2024-37085 lets attackers bypass authentication on VMware ESXi systems connected to an Active Directory domain.
SonicWall patched SSLVPN Vuln Allowing Firewall Crashing
GitLab Releases Security Update For Multiple Vulns
ISPAB president “whatsapp” got hacked via phishing link
Zyxel released patches 2 vulns in its USG FLEX H series firewalls
South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked
ChatGPT Develops Exploit for CVEs Before Public PoCs Share
TP-Link Router Vulns Allow to Execute Malicious SQL Commands
SSL.com’s domain validation system’s bug found: Hacker exploited
Amazon Follows Microsoft’s Lead, Halts Some Data Center Deals
Hackers Exploit Zoom’s Remote Control Feature for System Access
By using this flaw, the BlackByte operators can create a harmful “ESX Admins” group and add users to it, giving them full administrative privileges on the ESXi hypervisor.
Cisco Talos researchers found that BlackByte has been using this vulnerability in recent attacks. They noticed that the group keeps improving its use of vulnerable drivers to evade security measures and spread a ransomware encryptor that can self-propagate like a worm.
Free Webinar on Detecting & Blocking Supply Chain Attack -> Book your Spot
Exploit Chain:
Initial access is gained through valid VPN credentials, likely obtained via brute-force attacks.
The attackers escalate privileges by compromising Domain Admin accounts.
They create an “ESX Admins” Active Directory group and add malicious accounts to it.
This grants the attackers full administrative access to domain-joined ESXi hypervisors due to the CVE-2024-37085 vulnerability.
The BlackByte ransomware is then deployed, which uses a self-propagating mechanism to spread across the network.
The latest version of the BlackByte ransomware appends the “.blackbytent_h” extension to encrypted files. It also drops four vulnerable drivers as part of its Bring Your Own Vulnerable Driver (BYOVD) technique to bypass security controls:
RtCore64.sys (MSI Afterburner driver)
DBUtil_2_3.sys (Dell firmware update driver)
zamguard64.sys (Zemana Anti-Malware driver)
gdrv.sys (GIGABYTE driver)
click here to read out the full report.
