RANSOMWARE OPERATORS EXPLOIT HYPERVISOR VULNERABILITY FOR MASS ENCRYPTION

Summary from the TLDR InfoSec newsletter

Microsoft has posted a warning about a vulnerability in domain joined ESXi hypervisors. ESXi hypervisors were found to consider any member of the AD group “ESX Admins” to have full administrative privileges. Microsoft recommends applying the latest patches. The post includes threat hunting queries.