GhostFrame ESXi implant linked to Settra ransomware, Insikt says
The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.
74
Malware
vmhostd-core
- Mentions · 7d1
- Mentions · 30d1
- All mentions1
- First seenNov 10, 2026
- Last mentioned1d ago
Timeline
1 articles · newest firstAppears with
- gfsoxmalware · 1
- VMwarevendor · 1
- ESXiproduct · 1
- VMkatzmalware · 1
- Settramalware · 1
- sdkmonmalware · 1
- Insikt Grouporganization · 1
- GhostFramemalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.