InfoSecBulletin Cybersecurity for mankind
The BlackByte ransomware group is suspected of using a recently fixed security issue in VMware ESXi hypervisors. They are also taking advantage of weak drivers to bypass security measures.
A vulnerability named CVE-2024-37085 lets attackers bypass authentication on VMware ESXi systems connected to an Active Directory domain.
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
By using this flaw, the BlackByte operators can create a harmful “ESX Admins” group and add users to it, giving them full administrative privileges on the ESXi hypervisor.
Cisco Talos researchers found that BlackByte has been using this vulnerability in recent attacks. They noticed that the group keeps improving its use of vulnerable drivers to evade security measures and spread a ransomware encryptor that can self-propagate like a worm.
Free Webinar on Detecting & Blocking Supply Chain Attack -> Book your Spot
Exploit Chain:
Initial access is gained through valid VPN credentials, likely obtained via brute-force attacks.
The attackers escalate privileges by compromising Domain Admin accounts.
They create an “ESX Admins” Active Directory group and add malicious accounts to it.
This grants the attackers full administrative access to domain-joined ESXi hypervisors due to the CVE-2024-37085 vulnerability.
The BlackByte ransomware is then deployed, which uses a self-propagating mechanism to spread across the network.
The latest version of the BlackByte ransomware appends the “.blackbytent_h” extension to encrypted files. It also drops four vulnerable drivers as part of its Bring Your Own Vulnerable Driver (BYOVD) technique to bypass security controls:
RtCore64.sys (MSI Afterburner driver)
DBUtil_2_3.sys (Dell firmware update driver)
zamguard64.sys (Zemana Anti-Malware driver)
gdrv.sys (GIGABYTE driver)
click here to read out the full report.
