Hackers Exploit ESXi Flaw for Devastating Ransomware Attacks

Microsoft and VMware disclosed CVE-2024-37085, a vulnerability in domain-joined ESXi hypervisors that improperly grants full administrative privileges to members of a domain group named "ESX Admins". Ransomware groups including Storm-0506 are actively exploiting this flaw—by creating or renaming groups and adding users—to gain hypervisor control, encrypt virtual machines, exfiltrate data, and move laterally; the report outlines the exploitation methods, a broader attack chain (Qakbot, CVE-2023-28252, Cobalt Strike, Pypykatz, SystemBC), and recommends applying VMware's patch immediately.