Blackbyte

BlackByte, a threat actor believed to be an offshoot of the notorious Conti group, has been observed by cybersecurity experts exploiting a recently disclosed VMware ESXi vulnerability (CVE-2024-37085) to gain control over virtual machines and escalate privileges within compromised environments. This marks a significant departure from BlackByte's traditional techniques, such as exploiting known vulnerabilities in widely used software like Microsoft Exchange or using phishing and brute-force attacks. The exploitation of this authentication bypass vulnerability allows attackers to gain full administrative access to hypervisors, demonstrating BlackByte's ability to swiftly integrate new vulnerabilities into its toolkit. For the first time, Talos Incident Response (IR) detected a new variant of BlackByte ransomware, dubbed BlackByte NT, in addition to the previously seen LockBit ransomware. The attackers initially compromised a valid account to gain access, escalating privileges quickly once inside the network. Often, they create and manipulate Active Directory domain objects to gain control over critical systems. This new variant reflects BlackByte's evolution towards using advanced programming languages like C/C++ in their encryptor, aiming to make their malware more resistant to detection and analysis through sophisticated anti-analysis and anti-debugging techniques. The self-propagating nature of the BlackByte encryptor presents additional challenges for defenders. Regular hardening and patching of ESXi hosts are required to address vulnerabilities promptly. According to cybersecurity experts, the focused effort by BlackByte and similar threat actors to exploit vulnerabilities in ESXi indicates an intent to compromise the core infrastructure of enterprise networks. As such, BlackByte's pivot, as discovered by Cisco Talos Incident Response, highlights its capacity to rapidly incorporate new vulnerabilities into its toolkit, underscoring the evolving nature of the threat it poses.