Threats tagged 'settra'

CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS affecting GlobalProtect portal and gateway components. Exploitation allows unauthorized attackers to establish VPN connections without valid credentials. Ransomware groups such as Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra actively exploit this flaw to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Attackers also pivot to virtualization infrastructure by accessing vCenter management appliances, disabling ESXi hypervisor security controls, and performing offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.

Settra is a ransomware variant first observed in June 2026 that targets organizations via VPN access or compromised credentials. It achieves persistence by deploying MeshAgent RMM and encrypts files with .locked or .locked_wip extensions, dropping ransom notes named RESTORE_FILES.txt. The ransomware also inhibits recovery by clearing Windows event logs and disabling Windows recovery options using reagentc and diskpart utilities. One incident involved Bring Your Own Vulnerable Driver (BYOVD) tactics using the vulnerable driver gdrv.sys. Attackers made an operational security error by misspelling the Windows Defender Event Log path, preventing its deletion. The attacks affected consumer services, retail, and manufacturing sectors and used different command and control IP addresses.