New incident response findings from Cisco Talos Incident Response reveal that BlackByte — the Conti-linked ransomware-as-a-service group active since mid-2021 — has continued iterating its tooling at a pace that outstrips its public data leak site activity, with Talos assessing that only 20 to 30 percent of successful BlackByte attacks result in an extortion post. The latest encryptor variant introduces a new file extension, escalates its BYOVD driver count to four, exploits a recently disclosed VMware ESXi authentication bypass, and embeds stolen victim credentials directly into the ransomware binary to support worm-like self-propagation.
Initial Access and ESXi Exploitation
In the investigated incident, BlackByte gained initial access via valid VPN credentials — likely brute-forced against an interface that permitted domain account authentication without MFA. After privilege escalation to two Domain Admin-level accounts, the attackers accessed the organization's VMware vCenter server, created Active Directory domain objects for individual ESXi hypervisors, and added accounts to an AD group called "ESX Admins" — a setup designed to exploit CVE-2024-37085, an authentication bypass vulnerability in VMware ESXi that grants members of a specific AD group elevated privileges over virtual machines, host configuration, and system diagnostics. Talos observed BlackByte weaponizing this vulnerability within days of its public disclosure, highlighting the group's active vulnerability monitoring posture.
Four-Driver BYOVD Package
The newest BlackByte encryptor (appending the blackbytent_h extension) drops four vulnerable drivers — up from two or three in prior versions — each named with eight random alphanumeric characters followed by an iterating numeric suffix:
- RtCore64.sys — originally part of MSI Afterburner overclocking software.
- DBUtil_2_3.sys — part of Dell Client firmware update utility.
- zamguard64.sys (aka "Terminator") — from Zemana Anti-Malware, with notable recent reporting on its prevalence in attacker toolkits.
- gdrv.sys — from GIGABYTE Tools software.
The ransomware binary also disables Windows Defender via registry modifications, deletes system binaries including taskmgr.exe, perfmon.exe, and resmon.exe, and zeroes and self-deletes its own executable post-encryption via a ping-delayed fsutil command.
Credentials Baked Into the Binary
Dynamic sandbox analysis revealed that the BlackByte encryptor performs network share enumeration via the SRVSVC named pipe's NetShareEnumAll function using victim-specific Active Directory credentials — credentials that appeared in sandbox network traffic despite no external access, confirming they are hardcoded into the binary itself. This per-victim customization enables the ransomware's worm-like self-propagation: after installing itself as a service, the encryptor begins authenticating against reachable SMB hosts using stored credentials, producing multiple encryption waves hours after initial detonation. Talos notes that an enterprise-wide credential and Kerberos ticket reset should be highly effective for containment, given the binary's reliance on specific stolen account data.
Tradecraft Evolution and Defender Implications
BlackByte's progression through C#, Go, and now C/C++ reflects a deliberate effort to incorporate advanced anti-analysis and anti-debugging techniques. The group's rapid adoption of newly disclosed vulnerabilities — exploiting CVE-2024-37085 within days of publication — and its use of the victim's own VPN for remote access (avoiding commercial RAT deployment and reducing EDR visibility) demonstrate a threat actor actively refining its operational security alongside its tooling. Talos's BYOVD telemetry shows that professional, scientific, and technical services sectors face the greatest driver exposure, while over 32 percent of known BlackByte victims fall in the manufacturing vertical — figures Talos considers conservative given the gap between leak site posts and actual victim counts.