Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
Huntress details two Settra ransomware incidents where attackers deployed MeshAgent RMM and BYOVD before encrypting files.
Huntress analyzed two incidents involving the new Settra ransomware variant, first observed in June: a July attack on a consumer services/retail organization and a September attack on a manufacturer. In both, the ransomware executable was named after the victim's domain with a _win64.exe suffix, files were encrypted with .locked or .locked_wip extensions, and RESTORE_FILES.txt ransom notes were dropped. Attackers installed the MeshAgent RMM (C2 IPs 45.13.122[.]7 and 193.5.65[.]114) for persistent access, and the September incident showed BYOVD activity using gdrv.sys to disrupt security tooling. Post-encryption actions included clearing Windows Event Logs, disabling Windows Recovery Environment via reagentc /disable, flushing DNS, removing a recovery partition with diskpart, and overwriting free space with cipher /w.
- Settra ransomware first observed June; Huntress saw incidents in July and September
- MeshAgent RMM installed for persistent access, renamed mvtcs.exe in July incident
- September incident used gdrv.sys BYOVD to impair security tooling
- Anti-recovery actions: log clearing, reagentc disable, diskpart partition removal, cipher /w
- Ransomware binary named after victim domain, encrypts with .locked extensions
From the original article
6 min read at huntress.comHuntress has recently seen two incidents involving Settra, a ransomware variant that was first publicly reported in June 2026.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.