GhostFrame ESXi implant linked to Settra ransomware, Insikt says
The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.
Stories per day · 30 days
2 RSS
Relatedvmware6credential-theft3ghostframe3settra3broadcom2cisa-kev2kev2audit-logging1cisa1cloud-foundation1hypervisor1insufficient-logging1legal-sector1logging1misconfiguration1post-exploitation1proxmox1ransomware1
9 stories, newest first · one card per story
Stories tagged #esxi
ESXi and Proxmox ransomware cases from misconfigured credentials
Attackers compromised hypervisors via monitoring tools and reused root passwords without VM escapes.
CISA adds exploited VMware ESXi logging flaw CVE-2026-41709 to KEV
Federal remediation is due November 11, 2026; the CVSS 2.7 flaw only hides actions by someone who already has admin rights.
CISA lists VMware ESX logging flaw exploited by Warp Panda
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
Canada updates VMware advisory after two CVEs enter CISA KEV
CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.
ESXi Exploitation in the Wild
Huntress stopped an intrusion that used a VMware ESXi VM-escape toolkit after SonicWall VPN access.
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Kaspersky details PAYLOAD ransomware operators abusing Active Directory GPOs for encryptionless extortion at a Middle East manufacturer, exfiltrating data published on the dark web.
2
Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS
New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.
1
Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets
Aurora ransomware operators used Cursor AI running Claude Sonnet to plan and execute intrusions against dozens of organizations in nine countries.
15