Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption | Microsoft Security Blog
Tags
attack-pattern: Data Direct Model Credentials - T1589.001 Domain Groups - T1069.002 Malware - T1587.001 Malware - T1588.001 Python - T1059.006 Remote Desktop Protocol - T1021.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 Brute Force - T1110 Hypervisor - T1062 Remote Desktop Protocol - T1076
Show in Graph
Common Information
Type Value
UUID 7379497f-43b9-4253-a2f2-3012382f2120
Fingerprint a5b2099d9eefcc85
Analysis status DONE
Considered CTI value 2
Text language
Published July 29, 2024, 9 a.m.
Added to db Aug. 31, 2024, 7:22 a.m.
Last updated Nov. 17, 2024, 1:48 p.m.
Headline Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption
Title Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption | Microsoft Security Blog
Detected Hints/Tags/Attributes 77/1/10
Source URLs
Redirection Url
Details Source https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
URL Provider
Details Provider Source level domain
Details microsoft.com www.microsoft.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 173 ✔ Microsoft Security Blog https://microsoft.com/security/blog/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CVE 26 
cve-2024-37085
Details CVE 73 
cve-2023-28252
Details Domain 107 
aka.ms
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 8 
Storm-0506
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 7 
Storm-1175
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 4 
Storm-0569
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 2 
Storm-1113
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 2 
Storm-1674
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 10 
Storm-1811
Details Url 22 
https://aka.ms/threatintelblog.