New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems

A newly observed ransomware operation dubbed SETTRA is abusing the legitimate MeshAgent remote monitoring and management platform for persistence while using recovery-inhibition and defense-evasion techniques to maximize the impact of Windows encryption attacks.

Huntress investigated two SETTRA incidents in July and September 2026, uncovering a repeatable operational pattern involving victim-specific ransomware binaries, Windows log clearing, disabled recovery capabilities, and, in one case, bring-your-own-vulnerable-driver (BYOVD) activity.

Earlier incident-response reporting linked the actor to compromised VPN credentials and the use of previously stolen valid accounts, enabling it to enter enterprise environments without immediately deploying an exploit.

MOXFIVE has also documented the group’s use of NetExec, PAExec, ProcDump, Mimikatz, and the edr_blind utility during its broader attack lifecycle, indicating an operator that blends commodity offensive tools with legitimate administrative software.

Huntress could not conclusively identify the initial-access route in its two cases.

However, the post-compromise activity was strikingly consistent. In both intrusions, the ransomware executable was named after the victim organization’s domain and suffixed with _win64.exe, a naming convention that may help operators identify payloads tailored to individual victims or reduce operational mistakes during multi-target campaigns.

The July incident affected an organization in the consumer services and retail sector, while the September case involved a manufacturing company.

In the July attack, the first endpoint detection signal involved a renamed MeshAgent binary, mvtcs.exe, communicating with 45.13.122[.]7.

Huntress analysts said that, SETTRA first emerged publicly in June 2026 and is considered a ransomware and data-extortion operation motivated by financial gain.

SETTRA Ransomware

MeshAgent is a legitimate remote-management agent, but its deployment by an intruder provides an interactive and persistent foothold that can survive beyond the initial access session.

The ransomware was subsequently launched from C:\Perflogs, encrypted files with the .locked extension, and created RESTORE_FILES.txt ransom notes.

The encryption phase was paired with destructive anti-recovery actions. SETTRA cleared multiple Windows Event Logs, executed reagentc /disable to disable the Windows Recovery Environment, flushed the DNS resolver cache with ipconfig /flushdns, and invoked diskpart through an unrecovered script believed to target the recovery partition.

The operators also ran cipher /w:D:\ >nul 2>&1, which overwrites free space on the D: volume and makes restoration of previously deleted files substantially more difficult.

This sequence shows that SETTRA is not relying solely on encryption; it is actively reducing both forensic visibility and recovery options.

The September intrusion introduced a more aggressive defense-evasion component. Huntress observed the gdrv.sys driver, an indicator of BYOVD activity.

BYOVD attacks abuse legitimately signed but vulnerable kernel drivers to obtain privileged kernel-level capabilities, potentially enabling attackers to interfere with security products or crash antivirus-related services.

MeshAgent was again installed, this time without renaming, and connected to 193.5.65[.]114, an address present both in the executable’s certificate information and in active endpoint network connections.

Files in the second incident were encrypted with the .locked_wip extension, while RESTORE_FILES.txt appeared across affected directories.

The ransomware again disabled Windows recovery functions and attempted to clear operational logs covering PowerShell, Sysmon, WinRM, Task Scheduler, RDP activity, Security, System, and Defender telemetry.

However, the actors misspelled the Microsoft Defender log channel as Microsoft-Windows-Defender/Operational rather than Microsoft-Windows-Windows-Defender/Operational, leaving the intended Defender event log intact.

That mistake is a reminder that retained endpoint telemetry can provide critical evidence even during otherwise destructive ransomware operations.

Organizations should treat unexpected MeshAgent deployment, suspicious driver installation, log-clearing commands, reagentc /disable, and unattended diskpart activity as high-priority ransomware precursors.

VPN access should be protected with phishing-resistant MFA, while privileged credentials require rapid rotation following suspected compromise.

Security teams should also centrally forward Windows logs, enforce application controls for authorized RMM tools, block known vulnerable drivers where possible, and maintain offline or immutable backups inaccessible through ordinary domain accounts.

These controls directly address the access, persistence, evasion, and recovery-sabotage techniques reported across SETTRA incidents.

IOCs

Item	Description
45.13.122[.]7	MeshAgent C2 address in July incident; MeshAgent renamed to mvtcs.exe.
193.5.65[.]114	MeshAgent C2 address in September incident.
WIN-LIVFRVQFMKO	Malicious workstation linked to the September incident and previous incidents.
RESTORE_FILES.txt	Ransom note created in both incidents.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC