GhostFrame toolkit hijacks VMware ESXi hosts and steals Windows credentials
Original title: New GhostFrame Malware Lets Hackers Hijack VMware ESXi VMs and Steal Windows Credentials
Recorded Future says TAG-218, overlapping Settra, needs existing ESXi root and dumps guest secrets without guest malware.
Insikt Group describes GhostFrame, a control panel and ESXi implant that persists as vmhostd-core, disables the host firewall and execInstalledOnly, and manages virtual machines, VNC, and a SOCKS5 proxy. VMkatz and related components can recover NTLM hashes, Kerberos tickets, and NTDS.dit data from snapshots or virtual disks without malware inside the guest. The same infrastructure was linked to TAG-218 VPN intrusions and Settra leak-site victims; Insikt does not know how widely the toolkit is shared.
Unconfirmed: Insikt Group does not know whether GhostFrame is limited to Settra or how it is shared.
- The operator must already have root on the ESXi host; no bug is exploited for entry.
- The implant writes to /opt/vmhostd-core and restarts via /etc/rc.local.d/local.sh.
- It tries ports 53, 2222, 3389, 4444, 8443, and 9443 at once, then loads code in memory.
- TAG-218 hit SonicWall, Palo Alto Networks, and Fortinet VPNs from late August to October 2026.
- Four of those victims later appeared on the Settra leak site, Insikt Group says.
Impact: Full ESXi control and Windows credential theft from guest disks
- 1.Restrict ESXi management to trusted systems and investigate unexpected root logins.
- 2.Watch /etc/rc.local.d/local.sh, new files under /opt, and repeated firewall or execInstalledOnly changes.
- 3.Hunt six near-simultaneous connections from one ESXi host and patch VPN devices.
- ATT&CK
- T1562.004 Disable or Modify System FirewallT1036.005 Match Legitimate Name or LocationT1003 OS Credential DumpingT1090 ProxyT1059.004 Unix Shell
- Products
- ESXiGlobalProtect
- Malware
- GhostFrameVMkatzMeshAgent
- Organizations
- Recorded FutureHuntress
- Countries
- United States
From the original article
4 min read at cybersecuritynews.com
A new hacking toolkit called GhostFrame gives criminals a single control panel for taking over VMware ESXi servers and the virtual machines that run on them. Researchers at Recorded Future’s Insikt Group found the framework while tracking a group named TAG-218, whose activity overlaps with Settra ransomware. The tool can also pull Windows passwords out […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.