Threats Tagged 'recovery inhibition'

Settra is a ransomware variant first observed in June 2026 targeting organizations via VPNs or compromised credentials. It uses MeshAgent RMM for persistence and encrypts files with .locked or .locked_wip extensions. The ransomware deploys ransom notes named RESTORE_FILES.txt, clears Windows event logs, and disables Windows recovery options using reagentc and diskpart. One incident involved Bring Your Own Vulnerable Driver (BYOVD) tactics with gdrv.sys. Attackers made an operational security error by misspelling the Windows Defender Event Log path, preventing its deletion. Two incidents in July and September 2026 affected consumer services, retail, and manufacturing sectors. The attacks showed similar patterns but used different command and control IP addresses.