New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
New SETTRA ransomware operation abuses MeshAgent RMM for persistence, BYOVD via gdrv.sys, log clearing, and Windows recovery sabotage to encrypt systems.
Huntress investigated two SETTRA ransomware incidents in July and September 2026 at a consumer services/retail organization and a manufacturer, finding victim-specific binaries, MeshAgent RMM persistence, and BYOVD use of the gdrv.sys driver. The operator disabled Windows Recovery Environment, cleared event logs, overwrote free space with cipher, and encrypted files with .locked and .locked_wip extensions. Earlier reporting linked the group to compromised VPN credentials and tools including NetExec, PAExec, ProcDump, Mimikatz, and edr_blind.
- Ransomware binaries named after victim domains; files encrypted with .locked and .locked_wip extensions.
- September intrusion used vulnerable driver gdrv.sys, indicating BYOVD defense evasion.
- Operators misspelled the Defender event log channel, leaving critical telemetry intact.
- MeshAgent C2 traffic observed at 45.13.122[.]7 and 193.5.65[.]114.
- Linked to compromised VPN credentials; toolset includes NetExec, PAExec, ProcDump, Mimikatz, edr_blind.
- ATT&CK
- T1078 Valid AccountsT1219 Remote Access SoftwareT1070.001 Clear Windows Event LogsT1490 Inhibit System RecoveryT1486 Data Encrypted for Impact
- Products
- MeshAgent
- Threat actors
- SETTRA
- Malware
- SETTRA ransomware
From the original article
3 min read at gbhackers.com
A newly observed ransomware operation dubbed SETTRA is abusing the legitimate MeshAgent remote monitoring and management platform for persistence while using recovery-inhibition and defense-evasion techniques to maximize the impact of Windows encryption attacks.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.