Settra ransomware, first seen in June 2026, targets organizations through VPN access or stolen credentials. It achieves persistence by deploying MeshAgent RMM, naming ransomware executables after victim domains. The malware encrypts files appending .locked or .locked_wip extensions and drops ransom notes named RESTORE_FILES.txt. It also inhibits recovery by clearing Windows event logs and disabling recovery features using reagentc and diskpart utilities. One attack used Bring Your Own Vulnerable Driver (BYOVD) techniques with the vulnerable driver gdrv.sys. An operational security mistake by the attackers prevented deletion of the Windows Defender Event Log. Both attacks followed similar operational tactics but communicated with different C2 IP addresses (45.13.122.7 and 193.5.65.114). The incidents impacted consumer services, retail, and manufacturing sectors.

The ransomware encrypts victim files, disrupting normal operations in affected organizations. It inhibits recovery by clearing event logs and disabling Windows recovery options, complicating incident response and recovery efforts. The use of BYOVD techniques may allow privilege escalation or evasion of security controls. The operational security failure by attackers did not reduce impact but indicates potential for forensic analysis. The attacks affected multiple sectors, indicating broad targeting.

No official patch or fix is available as this is malware rather than a software vulnerability. Organizations should focus on prevention by securing VPN access and credentials, monitoring for unauthorized MeshAgent RMM deployments, and employing endpoint detection and response solutions. Incident response should include forensic analysis of event logs and recovery of encrypted files from backups. The vendor does not provide specific remediation for this malware; standard ransomware response procedures apply.