Ransomware Exploiting VMware ESXi Authentication Bypass

Microsoft has warned of active exploitation of CVE-2024-37085, a medium-severity authentication bypass vulnerability in VMware ESXi. Threat actors such as Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest are leveraging this flaw to escalate privileges, often leading to the deployment of Akira and Black Basta ransomware. The vulnerability allows attackers with sufficient Active Directory permissions to gain full VIM Admin roles on ESXi hosts by manipulating the 'ESX Admins' group.

Technically, the attack chain involves an initial intrusion—often via malware like Qakbot—followed by the creation or renaming of an AD group to 'ESX Admins'. Because ESXi hosts joined to a domain grant this group administrative rights by default, the attackers can swiftly move from domain access to full hypervisor control. This enables the mass encryption of hosted virtual machines and theft of sensitive data.

This trend represents a significant shift in adversary focus toward critical infrastructure components. Hypervisors are high-value targets because they host multiple workloads; taking control of a single ESXi host can cause widespread operational outages. Organizations using ESXi with AD integration are urged to patch immediately and review their default ESX Admin group settings.