GhostFrame ESXi implant used by TAG-218 to take over hypervisors ahead of Settra ransomware extortion
Recorded Future's Insikt Group reports that the group tracked as TAG-218 deployed the GhostFrame ESXi implant, a post-exploitation tool that lets operators control guest virtual machines from the hypervisor, during intrusions against perimeter VPN appliances from SonicWall, Fortinet and Palo Alto Networks between late August and October 2026. Researchers assess a strong operational overlap, not exclusive ownership, between TAG-218 and Settra ransomware, and at least four targeted organizations later appeared on the Settra extortion portal. The implant includes no initial-access exploit of its own, so the operator must already hold root on the ESXi host before generating a payload. The article cites Palo Alto Networks and Huntress as reinforcing the pattern, with Palo Alto warning about attackers exploiting the GlobalProtect authentication bypass CVE-2026-0257. Web research for this record did not retrieve the Recorded Future report, a vendor advisory for CVE-2026-0257 or any fixed release, so severity, prerequisites and fixed versions rest on the article alone.
Detalhes técnicos
The ELF binary copies itself to a local system directory and edits the hypervisor's startup script to survive reboots. It masquerades as vmhostd, a name resembling VMware's legitimate vmware-hostd daemon. A loop running every five seconds turns off the ESXi firewall and disables the unsigned-binary restriction, and the implant triggers the hypervisor's built-in backup script to make those weakened settings persistent.
For command and control, the implant launches simultaneous TCP connection attempts to ports 53, 2222, 3389, 4444, 8443 and 9443, keeps the first one that succeeds and closes the others. If every attempt fails within 30 seconds, it waits five to 12 seconds before retrying. Over an active link it works as an in-memory loader for received shellcode, without writing files to disk.
From the control panel, operators can list guest VMs, change power states, manage snapshots, enable VNC to view guest desktops, and deploy the gfsox SOCKS5 proxy module to pivot into internal networks. For credential theft, the sdkmon module alters service configurations to capture usernames and passwords from future ESXi logins, and the panel integrates the open-source VMkatz utility to scan VM memory snapshots and disk images for NTLM hashes, Kerberos tickets, LSA secrets and Active Directory databases without installing anything inside the guests. On October 12, 2026, Recorded Future observed a compromised Fortinet VPN appliance communicating with a MeshCentral management server that Huntress had previously linked to Settra attacks, and with GhostFrame control infrastructure.
Remediação
Restrict root management access to ESXi hosts and patch perimeter VPN appliances against CVE-2026-0257. Inspect hypervisor startup scripts for unauthorized changes and hunt for rogue processes masquerading as vmhostd. Because the implant reapplies the firewall and unsigned-binary changes every five seconds, repeated configuration changes point to an active infection. On the network, watch for bursts of six simultaneous outbound TCP SYN packets from an ESXi host toward one external IP across ports 53, 2222, 3389, 4444, 8443 and 9443.
Linha do tempo
-
GhostFrame: A new ESXi Implant Linked to Settra Ransomware
ler a análise desta fonte ocultar
GhostFrame is a previously undocumented post-exploitation framework that gives threat actors extensive control over compromised VMware ESXi environments. Once an attacker gains root-level access to an ESXi host, GhostFrame provides a single interface to access virtual machines running on the hypervisor, harvest credentials, execute commands, and pivot deeper into victim networks. Insikt Group identified GhostFrame being used by TAG-218, a threat activity group whose operations overlap with Settra ransomware.
GhostFrame is notable because it allows threat actors to operate from the virtualization layer, where a single compromised ESXi host can provide access to multiple virtual machines and the systems and data they contain. Insikt Group’s findings demonstrate how attackers can use compromised hypervisors as a centralized platform for post-exploitation activity, potentially expanding access across victim environments without compromising each virtual machine individually. The discovery highlights the importance of treating virtualization infrastructure as a high-value target and monitoring ESXi hosts for signs of unauthorized access and post-exploitation activity.
-
GhostFrame ESXi implant used by TAG-218 to take over hypervisors ahead of Settra ransomware extortion
ler a análise desta fonte ocultar
Recorded Future's Insikt Group reports that the group tracked as TAG-218 deployed the GhostFrame ESXi implant, a post-exploitation tool that lets operators control guest virtual machines from the hypervisor, during intrusions against perimeter VPN appliances from SonicWall, Fortinet and Palo Alto Networks between late August and October 2026. Researchers assess a strong operational overlap, not exclusive ownership, between TAG-218 and Settra ransomware, and at least four targeted organizations later appeared on the Settra extortion portal. The implant includes no initial-access exploit of its own, so the operator must already hold root on the ESXi host before generating a payload. The article cites Palo Alto Networks and Huntress as reinforcing the pattern, with Palo Alto warning about attackers exploiting the GlobalProtect authentication bypass CVE-2026-0257. Web research for this record did not retrieve the Recorded Future report, a vendor advisory for CVE-2026-0257 or any fixed release, so severity, prerequisites and fixed versions rest on the article alone.
Technical Details
The ELF binary copies itself to a local system directory and edits the hypervisor's startup script to survive reboots. It masquerades as vmhostd, a name resembling VMware's legitimate vmware-hostd daemon. A loop running every five seconds turns off the ESXi firewall and disables the unsigned-binary restriction, and the implant triggers the hypervisor's built-in backup script to make those weakened settings persistent.
For command and control, the implant launches simultaneous TCP connection attempts to ports 53, 2222, 3389, 4444, 8443 and 9443, keeps the first one that succeeds and closes the others. If every attempt fails within 30 seconds, it waits five to 12 seconds before retrying. Over an active link it works as an in-memory loader for received shellcode, without writing files to disk.
From the control panel, operators can list guest VMs, change power states, manage snapshots, enable VNC to view guest desktops, and deploy the gfsox SOCKS5 proxy module to pivot into internal networks. For credential theft, the sdkmon module alters service configurations to capture usernames and passwords from future ESXi logins, and the panel integrates the open-source VMkatz utility to scan VM memory snapshots and disk images for NTLM hashes, Kerberos tickets, LSA secrets and Active Directory databases without installing anything inside the guests. On October 12, 2026, Recorded Future observed a compromised Fortinet VPN appliance communicating with a MeshCentral management server that Huntress had previously linked to Settra attacks, and with GhostFrame control infrastructure.
Remediation
Restrict root management access to ESXi hosts and patch perimeter VPN appliances against CVE-2026-0257. Inspect hypervisor startup scripts for unauthorized changes and hunt for rogue processes masquerading as vmhostd. Because the implant reapplies the firewall and unsigned-binary changes every five seconds, repeated configuration changes point to an active infection. On the network, watch for bursts of six simultaneous outbound TCP SYN packets from an ESXi host toward one external IP across ports 53, 2222, 3389, 4444, 8443 and 9443.