Skip to content
NewA calmer, faster ZeroHour
Malwarehigh

GhostFrame ESXi implant linked to Settra ransomware, Insikt says

Original title: GhostFrame: A new ESXi Implant Linked to Settra Ransomware

Recorded Futureby Lawrence Stowe & Jerrilee Plude ()6 min read
Read at recordedfuture.com
Part of a story covered by 3 sourcesGhostFrame ESXi implant linked to Settra needs existing rootMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.

Insikt Group identified GhostFrame, a post-exploitation framework for VMware ESXi hosts that already have root access. A web panel builds implants and manages sessions, including VM power, snapshots, VNC relay, and a tunneled HTML Host Client. The implant loads shellcode in memory or falls back to a reverse shell, and sdkmon is described as intercepting later ESXi logins.

Unconfirmed: The title links GhostFrame to Settra, but the excerpt does not describe the evidence.

Key facts
  • The builder produces vmhostd-core, which still requires existing root on the host.
  • Persistence copies the binary to /opt/vmhostd-core and edits /etc/rc.local.d/local.sh.
  • The sample tries TCP ports 53, 2222, 3389, 4444, 8443, and 9443 together.
  • VMkatz can pull NTLM, Kerberos, SAM, LSA, and NTDS.dit data from VMs.
  • SOCKS5 component gfsox routes operator traffic through the compromised hypervisor.
Security assessment · AI, from the article

Impact: Persistent ESXi control and credential theft from hosted Windows systems.

What to do
  1. 1.Hunt ESXi hosts for /opt/vmhostd-core and changes to /etc/rc.local.d/local.sh.
  2. 2.Watch for six near-simultaneous TCP SYNs to ports 53, 2222, 3389, 4444, 8443, and 9443.
  3. 3.Check for a vmhostd process that is not legitimate vmware-hostd.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1037.004 Boot or Logon Initialization Scripts: RC ScriptsT1562.001 Impair Defenses: Disable or Modify ToolsT1036.005 Masquerading: Match Legitimate Name or LocationT1003 OS Credential DumpingT1090 Proxy
Tags
ghostframeesxisettracredential-theftpost-exploitationvmware
Vendors
VMware
Products
ESXi
Malware
GhostFrameSettraVMkatzgfsoxsdkmonvmhostd-core
Organizations
Insikt Group

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
ipv4193.5.65.114rastructure. Indicators of Compromise Indicator Description 193[.]5[.]65[.]114 TAG-218 MeshCentral C2 45[.]158[.]196[.]81 TAG-218 Gh
ipv445.158.196.14118 MeshCentral C2 45[.]158[.]196[.]81 TAG-218 GhostFrame C2 45[.]158[.]196[.]141 TAG-218 Ghost Frame C2 a05eae6d07b82e2e5451a72266f21f
ipv445.158.196.81cator Description 193[.]5[.]65[.]114 TAG-218 MeshCentral C2 45[.]158[.]196[.]81 TAG-218 GhostFrame C2 45[.]158[.]196[.]141 TAG-218 Gh
sha256a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a108 GhostFrame C2 45[.]158[.]196[.]141 TAG-218 Ghost Frame C2 a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10 GhostFrame SHA-256 Hash

From the original article

6 min read at recordedfuture.com

GhostFrame is a new post-exploitation framework targeting VMware ESXi environments, linked to TAG-218 and Settra ransomware.

Recorded Future

By Lawrence Stowe & Jerrilee Plude · recordedfuture.com

Read the full article at Recorded Future

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.