GhostFrame framework targets VMware ESXi hosts that are already rooted
Insikt Group links the framework to TAG-218, whose activity overlaps Settra; it does not exploit a flaw to enter ESXi.
72
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 11, 2026
- Last mentioned15h ago
Timeline
2 articles · newest firstGhostFrame toolkit hijacks VMware ESXi hosts and steals Windows credentials
Recorded Future says TAG-218, overlapping Settra, needs existing ESXi root and dumps guest secrets without guest malware.
72
Appears with
- MeshAgentmalware · 2
- GhostFramemalware · 2
- VMwarevendor · 2
- VMkatzmalware · 2
- Recorded Futureorganization · 2
- Settrathreat actor · 2
- Palo Alto Networksvendor · 1
- ESXiproduct · 1
- gfsoxmalware · 1
- Fortinetvendor · 1
- VMware ESXiproduct · 1
- Huntressorganization · 1
- GlobalProtectproduct · 1
- SonicWallvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.