Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

GhostFrame ESXi implant linked to Settra needs existing root

3 sources · 3 articlesFirst reported Updated ()
What's new

November 11: GBHackers added two GhostFrame C2 addresses, five-second execInstalledOnly resets, and said TAG-218 hit VPN appliances in America and Europe.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Insikt Group says GhostFrame is a post-exploitation ESXi toolkit that needs root and can steal Windows credentials from guest VMs.

Recorded Future’s Insikt Group described GhostFrame on November 10 as a previously undocumented control panel and post-exploitation framework for VMware ESXi hosts that already have root access. The builder produces an ELF implant, vmhostd-core, which masquerades as vmhostd, persists via startup scripts, can disable the host firewall and execInstalledOnly, and loads shellcode in memory or falls back to a reverse shell. Operators can manage VM power, snapshots, VNC, a tunneled HTML Host Client, and a SOCKS5 proxy. VMkatz can recover NTLM, Kerberos, SAM, LSA, and NTDS.dit data from guest disks or snapshots without malware in the guest. According to Insikt, related infrastructure overlaps TAG-218 VPN intrusions and Settra leak-site victims; how widely the toolkit is shared is unknown.

Key facts
  • No ESXi vulnerability is used; existing root access is required.
  • Implant copies to /opt/vmhostd-core and restarts via /etc/rc.local.d/local.sh.
  • C2 tries TCP 53, 2222, 3389, 4444, 8443, and 9443, keeping the first connection.
  • Reported C2 addresses are 45.158.196.81 and 45.158.196.141.
  • Four TAG-218 victims later appeared on the Settra leak site, Insikt says.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 10, 2026Insikt Group publicly describes GhostFrame for ESXi · GBHackers

What each outlet adds

beyond the shared facts
  • Recorded FutureNames sdkmon, VMkatz data types, and SOCKS5 component gfsox.
  • Cyber Security NewsNames SonicWall, Palo Alto, and Fortinet VPN targets.
  • GBHackersPublishes two C2 IPs and five-second execInstalledOnly resets.
Vendors
VMwarePalo Alto NetworksSonicWallFortinet
Products
ESXiVMware ESXiGlobalProtect
Threat actors
TAG-218Settra
Malware
GhostFrameSettraVMkatzgfsoxsdkmonvmhostd-coreMeshAgent
Organizations
Insikt GroupRecorded FutureHuntress
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Recorded FutureFirst report

    GhostFrame ESXi implant linked to Settra ransomware, Insikt says

    The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.

  2. · 16h ago Cyber Security News

    GhostFrame toolkit hijacks VMware ESXi hosts and steals Windows credentials

    Recorded Future says TAG-218, overlapping Settra, needs existing ESXi root and dumps guest secrets without guest malware.

  3. · 14h ago GBHackers

    GhostFrame framework targets VMware ESXi hosts that are already rooted

    Insikt Group links the framework to TAG-218, whose activity overlaps Settra; it does not exploit a flaw to enter ESXi.