GhostFrame ESXi implant linked to Settra ransomware, Insikt says
The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.
74
Malware
Settra
- Mentions · 7d1
- Mentions · 30d4
- All mentions6
- First seenSep 18, 2026
- Last mentioned1d ago
Timeline
6 articles · newest firstRansomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
82
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
84
Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
88
New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
Huntress reports new Settra ransomware hit retail and manufacturing firms, using MeshAgent RMM, BYOVD, and Windows utilities to encrypt systems and block recovery.
65
New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing
Huntress details a new Settra ransomware variant deployed against retail and manufacturing victims since June, using MeshAgent RMM, recovery sabotage, and BYOVD techniques.
62
Related CVEs
by mentions- CVE-2026-025796%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
Appears with
- Qilinthreat actor · 3
- GlobalProtectproduct · 3
- PAN-OSproduct · 3
- Unit 42organization · 3
- Palo Alto Networksvendor · 3
- Spikey Scorpiusthreat actor · 2
- VMwarevendor · 2
- ESXiproduct · 2
- Settrathreat actor · 2
- Tarnished Scorpiusthreat actor · 2
- Veeamvendor · 2
- Incthreat actor · 2
- Microsoftvendor · 2
- MeshAgentproduct · 2
- Windowsproduct · 2
- Huntressorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.