Ransomware operators exploit ESXi vulnerability (Campaign)

Microsoft researchers disclosed CVE-2024-37085 affecting VMware ESXi hypervisors: a default Active Directory group name "ESX Admins" can be used (or created/renamed) to obtain full administrative privileges on domain-joined ESXi hosts, allowing attackers to access and encrypt guest VMs and move laterally. The flaw is being actively exploited by ransomware operators (e.g., Storm-0506 and Storm-1175) to deploy ransomware such as Akira and Black Basta; operators can exploit group creation/renaming or delayed privilege refresh. Organizations should upgrade ESXi to the latest versions and review AD group naming and privilege handling.