GhostFrame ESXi implant linked to Settra ransomware, Insikt says
The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.
Stories per day · 30 days
1 RSS
7 stories, newest first · one card per story
Stories tagged #settra
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability
Qilin and Settra ransomware gangs actively exploit Palo Alto GlobalProtect auth bypass CVE-2026-0257 to hijack VPN sessions and breach networks.
11
New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
Huntress reports new Settra ransomware hit retail and manufacturing firms, using MeshAgent RMM, BYOVD, and Windows utilities to encrypt systems and block recovery.
2
New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing
Huntress details a new Settra ransomware variant deployed against retail and manufacturing victims since June, using MeshAgent RMM, recovery sabotage, and BYOVD techniques.
1
New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
New SETTRA ransomware operation abuses MeshAgent RMM for persistence, BYOVD via gdrv.sys, log clearing, and Windows recovery sabotage to encrypt systems.
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
Huntress details two Settra ransomware incidents where attackers deployed MeshAgent RMM and BYOVD before encrypting files.
2