GhostFrame framework targets VMware ESXi hosts that are already rooted
Insikt Group links the framework to TAG-218, whose activity overlaps Settra; it does not exploit a flaw to enter ESXi.
72
Malware
GhostFrame
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenNov 10, 2026
- Last mentioned15h ago
Timeline
3 articles · newest firstGhostFrame toolkit hijacks VMware ESXi hosts and steals Windows credentials
Recorded Future says TAG-218, overlapping Settra, needs existing ESXi root and dumps guest secrets without guest malware.
72
GhostFrame ESXi implant linked to Settra ransomware, Insikt says
The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.
74
Appears with
- VMwarevendor · 3
- VMkatzmalware · 3
- Recorded Futureorganization · 2
- ESXiproduct · 2
- Settrathreat actor · 2
- MeshAgentmalware · 2
- gfsoxmalware · 2
- TAG-218threat actor · 2
- Insikt Grouporganization · 1
- sdkmonmalware · 1
- VMware ESXiproduct · 1
- Fortinetvendor · 1
- GlobalProtectproduct · 1
- Palo Alto Networksvendor · 1
- vmhostd-coremalware · 1
- Huntressorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.