The ransomware operators known as BlackByte appaear to have shifted tactics, pivoting away from targeting vulnerable devices and focusing instead on flawed VMware ESXi hypervisors.
The group has also started using remote desktop software sanctioned by the victim organization, instead of deploying commercial software themselves, new research from Cisco Talos has claimed.
