# MA-1138.092024: MyCERT Advisory - BlackByte Ransomware Exploits VMware ESXi

**Date:** 07 Sep 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1138.092024  
**Advisory ID:** MA-1138.092024

---

**1.0 Introduction**
Recently, BlackByte ransomware group is actively exploiting a recently patched authentication bypass vulnerability in VMware ESXi hypervisors to deploy ransomware and gain full administrative access to victim networks. This vulnerability, tracked as CVE-2024-37085.
**2.0 Impact**
By exploiting this vulnerability, the authentication bypass flaw allows attackers to gain administrator access, thereby compromising virtual machines and exploiting security control.
**3.0 Affected Products**
- VMware ESXi hypervisor
**4.0 Indicators of Compromised (IOCs)**
|  | --- | --- | **Hashes (SHA-256)** | **Description** | 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd | RtCore64.sys | 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5 | DBUtil\_2\_3.sys | 543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 | zamguard64.sys | 31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 | gdrv.sys |
**5.0 Mitre Att&ck Framework**
|  |
| --- | --- | --- | **Tactic:** | **Technique ID:** | **Tactic, Technique, Sub-Technique Description:** | **Initial Access** | T1078.002 | Initial Access: Valid Accounts: Domain Accounts |  | T1078.003 | Valid Accounts: Local Accounts | **Discovery** | T1018 | Discovery: Remote System Discovery |  | T1083 | Discovery: File and Directory Discovery | **Persistence** | T1136.002 | Persistence: Create Account: Domain Account | **Execution** | T1204 | Execution: User Execution |  | T1569.002 | Execution: System Services: Service Execution | **Privilege Escalation** | T1543 | Privilege Escalation: Create or Modify System Process |  | T1484.001 | Privilege Escalation: Domain Policy Modification |  | T1484 | Privilege Escalation: Domain Modification |  | T1098 | Privilege Escalation: Account Manipulation | **Lateral Movement** | T1021.002 | Remote Services: SMB/Windows Admin Shares |  | T1021.001 | Remote Services: Remote Desktop Protocol |  | T1210 | Exploitation of Remote Services | **Resource Development** | T1608 | Resource Development: Stage Capabilities | **Defense Evasion** | T1562.001 | Defense Evasion: Impair Defenses: Disable or Modify Tools |  | T1112 | Defense Evasion: Modify Registry |  | T1070.004 | Defense Evasion: Indicator Removal: File Deletion |  | T1211 | Defense Evasion: Exploitation for Defense Evasion | **Impact** | T1529 | Impact: System Shutdown/Reboot |  | T1486 | Impact: Data Encrypted for Impact |
**6.0 Recommendations**
CyberSecurity Malaysia encourages users and administrators to review the [Broadcom’s Security Advisories](https://www.broadcom.com/support/vmware-security-advisories)and apply the necessary updates.
Kindly refer to the following URL: <https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505>
Generally, we advise users of this device to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999 through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17.30 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**7.0    References**
- <https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505>
- <https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/>
- [Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/?msockid=2c8d808e094d668e18e7936508da67c8)
- [VMware ESXi 8.0 Update 3 Release Notes](https://docs.vmware.com/en/VMware-vSphere/8.0/rn/vsphere-esxi-803-release-notes/index.html)
- [CVE - CVE-2024-37085 (mitre.org)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-37085)