InfoSecBulletin Cybersecurity for mankind
The BlackByte ransomware group is suspected of using a recently fixed security issue in VMware ESXi hypervisors. They are also taking advantage of weak drivers to bypass security measures.
A vulnerability named CVE-2024-37085 lets attackers bypass authentication on VMware ESXi systems connected to an Active Directory domain.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
By using this flaw, the BlackByte operators can create a harmful “ESX Admins” group and add users to it, giving them full administrative privileges on the ESXi hypervisor.
Cisco Talos researchers found that BlackByte has been using this vulnerability in recent attacks. They noticed that the group keeps improving its use of vulnerable drivers to evade security measures and spread a ransomware encryptor that can self-propagate like a worm.
Free Webinar on Detecting & Blocking Supply Chain Attack -> Book your Spot
Exploit Chain:
Initial access is gained through valid VPN credentials, likely obtained via brute-force attacks.
The attackers escalate privileges by compromising Domain Admin accounts.
They create an “ESX Admins” Active Directory group and add malicious accounts to it.
This grants the attackers full administrative access to domain-joined ESXi hypervisors due to the CVE-2024-37085 vulnerability.
The BlackByte ransomware is then deployed, which uses a self-propagating mechanism to spread across the network.
The latest version of the BlackByte ransomware appends the “.blackbytent_h” extension to encrypted files. It also drops four vulnerable drivers as part of its Bring Your Own Vulnerable Driver (BYOVD) technique to bypass security controls:
RtCore64.sys (MSI Afterburner driver)
DBUtil_2_3.sys (Dell firmware update driver)
zamguard64.sys (Zemana Anti-Malware driver)
gdrv.sys (GIGABYTE driver)
click here to read out the full report.
