New SETTRA Ransomware Operation Exploits MeshAgent for Persistence and Evasion
A recently identified ransomware group, SETTRA, is leveraging the legitimate MeshAgent remote monitoring and management (RMM) platform to maintain persistence in compromised Windows environments while employing advanced defense-evasion and recovery-inhibition techniques. First observed in June 2026, the financially motivated operation combines commodity offensive tools with legitimate administrative software to maximize the impact of its attacks.
Incident Overview
Security firm Huntress investigated two SETTRA intrusions in July and September 2026, uncovering a repeatable attack pattern. The group gains initial access through compromised VPN credentials and previously stolen valid accounts, avoiding immediate exploit deployment. While the exact initial access vector remains unconfirmed in Huntress’s cases, post-compromise activity followed a consistent playbook:
- Victim-Specific Payloads: Ransomware executables were named after the target organization’s domain (e.g., victimdomain_win64.exe), suggesting tailored attacks or operational efficiency in multi-target campaigns.
- MeshAgent Abuse: The legitimate RMM tool was repurposed for persistence, providing attackers an interactive foothold. In the July incident (impacting a consumer services/retail firm), MeshAgent was renamed to mvtcs.exe and communicated with 45.13.122[.]7. In the September attack (targeting a manufacturing company), MeshAgent connected to 193.5.65[.]114 without renaming.
- Encryption and Destruction: Files were encrypted with extensions .locked (July) or .locked_wip (September), accompanied by RESTORE_FILES.txt ransom notes. The ransomware executed from C:\Perflogs and disabled recovery options via:
- reagentc /disable (Windows Recovery Environment)
- ipconfig /flushdns (DNS cache clearing)
- diskpart (targeting recovery partitions)
- *cipher /w:D:* (overwriting free disk space to hinder file restoration)
- Log Tampering: Attackers cleared Windows Event Logs, including PowerShell, Sysmon, and RDP activity. A misspelled Defender log channel (Microsoft-Windows-Defender/Operational) left critical telemetry intact, highlighting the value of retained logs despite destructive efforts.
- BYOVD Attack: The September incident featured gdrv.sys, a vulnerable kernel driver used in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass security controls and interfere with antivirus services.
Tooling and Tactics
SETTRA’s arsenal includes:
- NetExec, PAExec, ProcDump, Mimikatz (credential theft)
- edr_blind (EDR evasion)
- Legitimate RMM tools (MeshAgent) for persistence
Indicators of Compromise (IOCs)
- C2 Addresses: 45.13.122[.]7 (July), 193.5.65[.]114 (September)
- Ransom Note: RESTORE_FILES.txt
- Malicious Workstation: WIN-LIVFRVQFMKO (linked to September and prior incidents)
The group’s focus on log destruction, recovery sabotage, and BYOVD techniques underscores its intent to evade detection and complicate remediation. Organizations are advised to monitor for unexpected MeshAgent deployments, suspicious driver installations, and log-clearing commands as potential ransomware precursors.
Source: https://gbhackers.com/settra-ransomware/
MeshAgent cybersecurity rating report: https://www.rankiteo.com/company/meshagent
"id": "MES1789741844",
"linkid": "meshagent",
"type": "Ransomware",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Retail',
'type': 'Consumer services/retail firm'},
{'industry': 'Manufacturing',
'type': 'Manufacturing company'}],
'attack_vector': ['Compromised VPN credentials', 'Stolen valid accounts'],
'data_breach': {'data_encryption': 'Yes',
'type_of_data_compromised': 'Encrypted files'},
'date_detected': '2026-06-01',
'date_publicly_disclosed': '2026-09-01',
'description': 'A recently identified ransomware group, SETTRA, is leveraging '
'the legitimate MeshAgent remote monitoring and management '
'(RMM) platform to maintain persistence in compromised Windows '
'environments while employing advanced defense-evasion and '
'recovery-inhibition techniques. The group gains initial '
'access through compromised VPN credentials and previously '
'stolen valid accounts, avoiding immediate exploit deployment. '
'The ransomware executables were named after the target '
'organization’s domain, and MeshAgent was repurposed for '
'persistence. Files were encrypted with extensions .locked or '
'.locked_wip, accompanied by RESTORE_FILES.txt ransom notes. '
'The group also disabled recovery options and cleared Windows '
'Event Logs.',
'impact': {'data_compromised': 'Files encrypted with extensions .locked or '
'.locked_wip',
'operational_impact': 'Disabled recovery options, log tampering, '
'and hindered file restoration',
'systems_affected': 'Windows environments'},
'initial_access_broker': {'backdoors_established': 'MeshAgent repurposed for '
'persistence'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Monitor for unexpected MeshAgent deployments, suspicious '
'driver installations, and log-clearing commands as '
'potential ransomware precursors.',
'motivation': 'Financial gain',
'post_incident_analysis': {'root_causes': ['Compromised VPN credentials',
'Stolen valid accounts',
'Abuse of legitimate RMM tools']},
'ransomware': {'data_encryption': 'Yes', 'ransomware_strain': 'SETTRA'},
'recommendations': 'Organizations are advised to monitor for unexpected '
'MeshAgent deployments, suspicious driver installations, '
'and log-clearing commands as potential ransomware '
'precursors.',
'references': [{'source': 'Huntress'}],
'response': {'third_party_assistance': 'Huntress'},
'threat_actor': 'SETTRA',
'title': 'New SETTRA Ransomware Operation Exploits MeshAgent for Persistence '
'and Evasion',
'type': 'Ransomware'}