Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM

Settra is a ransomware variant first observed in June 2026 that targets organizations via VPN access or compromised credentials. It achieves persistence by deploying MeshAgent RMM and encrypts files with .locked or .locked_wip extensions, dropping ransom notes named RESTORE_FILES.txt. The ransomware also inhibits recovery by clearing Windows event logs and disabling Windows recovery options using reagentc and diskpart utilities. One incident involved Bring Your Own Vulnerable Driver (BYOVD) tactics using the vulnerable driver gdrv.sys. Attackers made an operational security error by misspelling the Windows Defender Event Log path, preventing its deletion. The attacks affected consumer services, retail, and manufacturing sectors and used different command and control IP addresses.

• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257ExploitedVulnerability2026-10-20
• Bulletproof Host Virtualine Loses Its Domain to FBI SeizureNews2026-10-30
• Aurora ransomware targets ESXi abuses Cursor Agent for exploitationMalware2026-10-29
• A quiet week in infosec <.<HighVulnerability2026-10-29
• IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor AssessmentNews2026-10-29