Vulnerabilitycritical
BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-37085 | Authentication Bypass in VMware ESXi via AD Group Recreation | 7.2 | 27% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 1.1.1.1 | cution, the ransomware binary executed the command `/c ping 1.1.1[.]1 -n 10 > Nul & fsutil file setZeroData offset=0 length=503 |
| ipv4 | 204.79.197.219 | ded: Communication with msdl.microsoft[.]com via IP address 204.79.197[.]219 early in the execution process. This site is associated w |
| sha256 | 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd | to prevent potential victim identification. RtCore64.sys – 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd DBUtil_2_3.sys – 0296e2ce999e67c76352613a718e11516fe1b0efc3 |
| sha256 | 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5 | 0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd DBUtil_2_3.sys – 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5 zamguard64.sys – 543991ca8d1c65113dff039b85ae3f9a87f503daec |
| sha256 | 31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 | 3dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 gdrv.sys – 31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 |
| sha256 | 543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 | 3a718e11516fe1b0efc3ffdb8918fc999dd76a73a5 zamguard64.sys – 543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 gdrv.sys – 31f4cfb4c71da44120752721103a16512444c13c2ac2d857 |
From the original article
12 min read at blog.talosintelligence.com
The BlackByte ransomware group continues to leverage tactics, techniques and procedures (TTPs) that have formed the foundation of its tradecraft since its inception, continuously iterating its use of vulnerable drivers to bypass security protections and deploying a self-propagating, wormable ransomware encryptor.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.