New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
Huntress reports new Settra ransomware hit retail and manufacturing firms, using MeshAgent RMM, BYOVD, and Windows utilities to encrypt systems and block recovery.
Huntress investigated two Settra intrusions: a consumer services and retail organization in July 2026 and a manufacturing firm in September 2026, showing nearly identical post-compromise behavior. Operators installed the MeshAgent RMM, ran ransomware executables named after the victim domain (_win64.exe), encrypted files with .locked or .locked_wip extensions, and dropped RESTORE_FILES.txt ransom notes. In both cases attackers cleared Windows Event Logs, disabled the Windows Recovery Environment, and used DiskPart to remove the recovery partition; the July case also ran Cipher to overwrite free space and flushed DNS cache. The September incident added BYOVD using gdrv.sys, and initial access was suspected via VPNs or previously stolen credentials, though unconfirmed.
- Two intrusions hit consumer services/retail in July and manufacturing in September with nearly identical post-compromise behavior
- MeshAgent RMM installed for persistence, connecting to attacker-controlled C2 servers in both incidents
- September attack used BYOVD with gdrv.sys to impair security tooling before encryption
- Recovery sabotage: event logs cleared, Windows RE disabled, DiskPart removed recovery partition, Cipher overwrote free space
- Initial access unconfirmed; suspected via VPNs or previously stolen credentials
- ATT&CK
- T1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1070.001 Clear Windows Event LogsT1219 Remote Access SoftwareT1562.001 Impair Defenses: Disable or Modify Tools
- Vendors
- Microsoft
- Threat actors
- Settra
- Malware
- Settra
- Organizations
- Huntress
- Countries
- United States
From the original article
4 min read at cybersecuritynews.com
Settra ransomware is emerging as a serious threat to Windows networks after investigators linked it to two recent intrusions involving remote-management software and recovery-blocking actions. The operation encrypts files, leaves victims with ransom notes, and tries to make both investigation and restoration more difficult. Public reporting indicates that the people behind Settra have gained entry […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.