Threat watch / Campaign
GhostFrame: an ESXi implant that steals Windows credentials from virtual machine snapshots, linked to Settra ransomware
Recorded Future's Insikt Group describes GhostFrame, a previously undocumented control framework that runs on compromised VMware ESXi hypervisors. It lets operators control guest virtual machines, pivot through the network and pull credentials out of VM snapshots and disks, so no malware runs inside the Windows machines. Insikt saw it used by TAG-218, a group whose operations overlap with Settra ransomware, which targeted VPN appliances in the US and Europe from late August to October 2026.
- Sector
- Many sectors
- Way in
- Not public yet
- Product or vendor
- VMware ESXi, SonicWall, Palo Alto Networks, Fortinet
- targeted organizations later listed on the Settra leak site[1]
- 4
- How it happened
- GhostFrame exploits no flaw itself: operators need root access to the ESXi host first. It then persists as a fake vmhostd service, keeps the ESXi firewall and execInstalledOnly disabled, and offers VM control, a SOCKS5 pivot, an ESXi login interceptor and VMkatz to extract secrets from VM memory snapshots and disk images. How the attackers got root in each case is not public; Insikt links the activity to targeting of SonicWall, Palo Alto Networks and Fortinet VPN appliances.[1][2] Checked 11 Nov 2026
- What was stolen
- Credentials taken from virtual machine snapshots and disks, including NTLM hashes, Kerberos tickets, SAM and LSA secrets and NTDS.dit data, plus ESXi logins captured by the sdkmon component, according to the analysis of the tool. What was taken from specific victims is not public.[1][2] Checked 11 Nov 2026
- Who was impacted
- Organizations whose VPN appliances in the US and Europe were targeted by TAG-218 between late August and October 2026. Four of the targeted organizations later appeared on the Settra leak site; no total count is public.[1] Checked 11 Nov 2026
- Threat actor
- Not attributed. Used by TAG-218, a group whose operations overlap with Settra ransomware, according to Recorded Future, which says the evidence does not show the tool is exclusive to Settra.
Timeline
- A victim's Fortinet VPN appliance is seen beaconing to both GhostFrame and MeshCentral servers, according to Recorded Future. From late August to October 2026, TAG-218 servers targeted VPN appliances in the US and Europe, predominantly SonicWall, Palo Alto Networks and Fortinet devices. [1]
- Recorded Future's Insikt Group publishes its analysis of GhostFrame, with indicators and detection advice: watch for changes to /etc/rc.local.d/local.sh, a vmhostd process, and attempts to disable the ESXi firewall or execInstalledOnly. [1]