Skip to content
NewA calmer, faster ZeroHour
Malwarehigh

GhostFrame framework targets VMware ESXi hosts that are already rooted

Original title: New GhostFrame Malware Targets VMware ESXi Servers to Steal Credentials and Hijack Virtual Machines

GBHackersby Divya ()3 min read
Read at gbhackers.com
Part of a story covered by 3 sourcesGhostFrame ESXi implant linked to Settra needs existing rootMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Insikt Group links the framework to TAG-218, whose activity overlaps Settra; it does not exploit a flaw to enter ESXi.

Recorded Future’s Insikt Group described GhostFrame on November 10 as a previously undocumented command-and-control and post-exploitation framework for compromised VMware ESXi hosts. It requires existing root access and can control virtual machines, relay sessions, proxy traffic and extract credentials. The ELF implant vmhostd-core persists through startup scripts and masquerades as vmhostd. The report links use to TAG-218, whose activity overlaps Settra ransomware.

Unconfirmed: GhostFrame’s exclusivity to Settra is unproven, and the published hash is described as only 60 hexadecimal characters.

Key facts
  • The implant copies itself to /opt/vmhostd-core and sets execInstalledOnly to 0 about every five seconds.
  • C2 tries TCP ports 53, 2222, 3389, 4444, 8443 and 9443, keeping the first connection.
  • Reported GhostFrame C2 addresses are 45.158.196.81 and 45.158.196.141.
  • TAG-218 infrastructure targeted VPN appliances in America and Europe from late August to October 2026.
  • Four organizations later appeared on Settra’s leak site, according to the report.
Security assessment · AI, from the article

Impact: Credential theft, VM control and internal access from a rooted ESXi host

ProductAffected
VMware ESXi—
What to do
  1. 1.Restrict ESXi administrative access and investigate startup-script and firewall persistence changes.
  2. 2.Watch for connection bursts to TCP ports 53, 2222, 3389, 4444, 8443 and 9443.
  3. 3.Check reported C2 addresses 45.158.196.81, 45.158.196.141 and 193.5.65.114.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1036 MasqueradingT1562.004 Disable or Modify System FirewallT1037.004 RC ScriptsT1003 OS Credential DumpingT1090 Proxy
Tags
ghostframeesxivmwaresettratag-218credential-theft
Vendors
VMware
Products
VMware ESXi
Threat actors
TAG-218Settra
Malware
GhostFrameMeshAgentVMkatzgfsox
Organizations
Recorded Future

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
ipv4193.5.65.11458[.]196[.]81 and 45[.]158[.]196[.]141, MeshCentral address 193[.]5[.]65[.]114, and the reported hash a05eae6d07b82e2e5451a72266f21f
ipv445.158.196.141ors include GhostFrame C2 addresses 45[.]158[.]196[.]81 and 45[.]158[.]196[.]141, MeshCentral address 193[.]5[.]65[.]114, and the repo
ipv445.158.196.81ence unresolved. Indicators include GhostFrame C2 addresses 45[.]158[.]196[.]81 and 45[.]158[.]196[.]141, MeshCentral address 193[.]5
sha256a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10shCentral address 193[.]5[.]65[.]114, and the reported hash a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10. That hash contains only 60 hexadecimal characters, so anal

From the original article

3 min read at gbhackers.com

Researchers have uncovered GhostFrame, a previously undocumented command-and-control (C2) and post-exploitation framework that turns compromised VMware ESXi hosts into platforms for credential theft, virtual machine control, and network intrusion. Insikt Group’s November 10 report links its use to TAG-218, whose activity overlaps with Settra ransomware.

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.