Ransomware Gangs Exploit ESXi Bug for Instant, Mass Encryption of VMs

Multiple ransomware groups have been exploiting VMware ESXi vulnerability CVE-2024-37085 — which grants full ESXi administrative access to any AD domain group named "ESX Admins" — to quickly escalate privileges and deploy ransomware (e.g., Black Basta, Akira) across virtualized environments; Broadcom has released a patch and organizations are urged to apply it and improve hypervisor hygiene and monitoring.