Black Byte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks
Summary: BlackByte, a ransomware-as-a-service group believed to be an offshoot of Conti and first observed in mid- to late-2021, gained initial access to a victim's VPN using valid credentials and escalated privileges by compromising two Domain Admin-level accounts. The actor used one account to join VMware ESXi hypervisors to the domain and create an "ESX Admins" group to exploit CVE-2024-37085, an ESXi authentication bypass, within days of its publication, then uninstalled EDR on key systems and changed ESXi root passwords before encryption.
What's compelling: Talos found BlackByte has been significantly more active than its data leak site suggests, with only an estimated 20 to 30 percent of victims eventually posted, and over 32 percent of known victims in manufacturing. The encryptor packs stolen victim credentials into the binary to spread itself, so an enterprise-wide user credential and Kerberos ticket reset is the containment step the source identifies as highly effective.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Mentions
- CVE-2024-37085
- Related
- CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Jul 30, 2024