A New ESXi Implant Linked to Settra Ransomware

GhostFrame is a previously undocumented post-exploitation framework enabling extensive control over compromised VMware ESXi environments. After root-level access is obtained, it provides a unified interface for accessing virtual machines, harvesting credentials, executing commands, and pivoting into victim networks. The framework operates from the virtualization layer, allowing attackers to control multiple VMs from a single compromised ESXi host. TAG-218, whose operations overlap with Settra ransomware, has been observed deploying GhostFrame following compromise of VPN appliances across the US and Europe. The implant establishes persistence, disables security controls, uses distinctive C2 communications across multiple ports, and integrates credential harvesting tools including VMkatz. This demonstrates how compromised hypervisors serve as centralized platforms for post-exploitation activities across virtualized environments.

• Aurora ransomware targets ESXi abuses Cursor Agent for exploitationMalware2026-10-29
• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257ExploitedVulnerability2026-10-20
• Key benefits of Zero Trust Network Access over corporate VPN access | Kaspersky official blogAnalysis2026-11-10
• C3RB3R attacks Synology NAS: how to protect your files | Kaspersky official blogHighVulnerability2026-11-09