InfoSecBulletin Cybersecurity for mankind
The BlackByte ransomware group is suspected of using a recently fixed security issue in VMware ESXi hypervisors. They are also taking advantage of weak drivers to bypass security measures.
A vulnerability named CVE-2024-37085 lets attackers bypass authentication on VMware ESXi systems connected to an Active Directory domain.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
By using this flaw, the BlackByte operators can create a harmful “ESX Admins” group and add users to it, giving them full administrative privileges on the ESXi hypervisor.
Cisco Talos researchers found that BlackByte has been using this vulnerability in recent attacks. They noticed that the group keeps improving its use of vulnerable drivers to evade security measures and spread a ransomware encryptor that can self-propagate like a worm.
Free Webinar on Detecting & Blocking Supply Chain Attack -> Book your Spot
Exploit Chain:
Initial access is gained through valid VPN credentials, likely obtained via brute-force attacks.
The attackers escalate privileges by compromising Domain Admin accounts.
They create an “ESX Admins” Active Directory group and add malicious accounts to it.
This grants the attackers full administrative access to domain-joined ESXi hypervisors due to the CVE-2024-37085 vulnerability.
The BlackByte ransomware is then deployed, which uses a self-propagating mechanism to spread across the network.
The latest version of the BlackByte ransomware appends the “.blackbytent_h” extension to encrypted files. It also drops four vulnerable drivers as part of its Bring Your Own Vulnerable Driver (BYOVD) technique to bypass security controls:
RtCore64.sys (MSI Afterburner driver)
DBUtil_2_3.sys (Dell firmware update driver)
zamguard64.sys (Zemana Anti-Malware driver)
gdrv.sys (GIGABYTE driver)
click here to read out the full report.
