Settra ransomware operators ran two intrusions through the open-source MeshAgent RMM
Huntress worked two Settra intrusions, in July and September, and found MeshAgent installed for remote control, Windows event logs cleared and recovery partitions removed. SOCRadar counts 93 victims claimed since June.
The Watch · Security desk
What happened
- Huntress reported two Settra ransomware intrusions in which the group installed MeshAgent, an open-source remote management agent, and in one case left signs of vulnerable-driver abuse.
- In the July incident MeshAgent was deployed as mvtcs.exe; in September it was installed unrenamed and pointed at a different IP address.
- Both ransomware executables were named after the victim's domain with _win64.exe appended and both wrote a ransom note called RESTORE_FILES.txt.
Why it matters
- What's now possible capability MeshAgent gives an operator full remote control using software an IT team could plausibly have installed itself, so the deciding control is whether an organisation keeps a list of RMMs it permits and alerts on everything outside it.
- Who's exposed exposure The recovery tampering happens before the ransom note, so by the time a victim knows, WinRE, the recovery partition and carvable free space are already gone and only off-host backups can restore.
- Who has to decide decision Huntress puts the best detection window at initial access. A shop that funds only post-compromise alerting gets its first alert after the operator already has remote control of a host.
- What doesn't add up contradiction The 93 figure is Settra's own leak-site accounting relayed by SOCRadar, while four victims are corroborated by published data, so the count measures what the group says it did.
Next story · Security · 8h ago
Semperis survey puts threats against ransomware victims' staff at 40% of attacksConfirmed2 publishers
MeshAgent is a working remote management agent for Windows, Linux, macOS and FreeBSD, published on GitHub, and the hosts it lands on are administered from a MeshCentral server [19]. The operator runs that server.
Huntress says it does not see the tool abused often. Lindsey O'Donnell-Welch, principal technical community engagement writer at Huntress, told SC Media that the company has seen MeshAgent across many attacks but that it is not one of the most common RMMs Huntress sees being abused, and that in previous attacks threat actors have installed renamed malicious MeshAgent instances and used MeshAgent instances to install further RMMs, such as ScreenConnect, for persistence [20].
In July the agent ran as mvtcs.exe [5]. In September it ran under its own name, to a different IP address [6], and Huntress found the vulnerable Gigabyte gdrv.sys kernel driver installed on the host, which it treated as possible bring-your-own-vulnerable-driver activity [7]. BYOVD is how operators disable security products from the kernel [8].
Before encryption, both intrusions ran the same anti-recovery work: the Windows Recovery Environment turned off with reagentc /disable, the recovery partition removed via diskpart, several Windows event logs cleared, and the DNS cache flushed with ipconfig /flushdns [9]. The first incident also used the Windows cipher utility to overwrite previously deleted free space [10]. In the September case the attacker's code misspelled "Microsoft-Windows-Windows-Defender/Operational", so that log survived the clearing routine [12]. The Huntress agent went on mid-incident there [11].
SOCRadar's total of 93 claimed victims since June 2026 [2] is roughly 23 a month across June to September [23]. MOXFIVE says at least four of those have had data published, about 4 percent of the claimed count [3][24], and has found no evidence Settra runs as a service for affiliates [3]. Negotiation happens over Tox chat [21]. The claimed victims sit in retail and hospitality, manufacturing and production, professional services, construction and engineering, and food and beverage, with no industry pattern MOXFIVE could identify beyond unpatched systems and exposed credentials [16].
Huntress puts the intervention earlier than the RMM alert. "The best opportunity for defenders to detect the attack and prevent encryption is during the threat actor's initial attempts to gain access. Defenders should also prioritize alerts for unauthorized MeshAgent instances or suspicious driver deployment, especially when followed by event-log clearing or recovery tampering, since these early post-compromise behaviors offer the best chance to stop Settra before encryption begins," O'Donnell-Welch told SC Media [15].
Huntress could not name the initial access vector in either the July or the September incident [4]. MOXFIVE and SOCRadar have previously tied Settra to compromised credentials, including VPN credentials, and to exploitation of unpatched software [18]. Reputation feeds were thin on the September infrastructure: 11 of 89 vendors on VirusTotal flag that C2 address, about 12 percent [22][25], and Huntress linked the same address and the workstation name to malicious activity going back to Dec. 24, 2024 [17].
What to watch
- Confirmation that gdrv.sys was loaded and used against endpoint agents in the September case, not only written to disk.
- Whether SOCRadar's claimed-victim total keeps climbing at the June-to-September rate.
- Other responders confirming Settra binaries named after the victim's own domain. That naming habit would hand defenders a cheap detection string.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Huntress reported Thursday on two recent attacks by an emerging threat called Settra ransomware, revealing use of the MeshAgent RMM and potential Bring Your Own Vulnerable Driver tactics.
- [2]
The Settra ransomware group has been active since June 2026 and has claimed a total of 93 victims, according to SOCRadar.
- [3]
Settra uses double extortion, with at least four of the claimed victims having their data leaked, and there is no evidence it operates under a ransomware-as-a-service model, according to MOXFIVE.
- [4]
The two attacks reported by Huntress occurred in July and September, and the initial access methods could not be determined.
- [5]
In the first incident, the MeshAgent RMM was deployed under the name mvtcs.exe.
- [6]
MeshAgent was also installed in the September attack, though it was not renamed, and it connected to a separate IP address.
- [7]
In the September attack Huntress found evidence of possible BYOVD tactics, specifically installation of the vulnerable Gigabyte gdrv.sys kernel driver.
- [8]
BYOVD is typically used to disrupt security tools at the kernel level.
- [9]
Evasion and anti-recovery tactics were observed in both incidents: clearing multiple Windows event logs, disabling the Windows Recovery Environment via "reagentc /disable", flushing the DNS cache with "ipconfig /flushdns", and using a script to run diskpart and remove the recovery partition in the first incident.
- [10]
The first incident also used the Windows "cipher" utility to overwrite previously deleted free space to make recovery of deleted data harder.
- [11]
In the second incident the Huntress agent was installed mid-incident, and the ransomware executable disabled the Windows Recovery Environment, removed the recovery partition and cleared several Windows event logs.
- [12]
An incorrect spelling of the "Microsoft-Windows-Windows-Defender/Operational" event log in the attacker's code prevented its deletion in the second incident.
- [13]
Both ransomware executables were named with the victim organization's domain appended with "_win64.exe", and in both cases a ransom note titled "RESTORE_FILES.txt" was created.
- [14]
In the first incident the executable was launched from C:\Perflogs and encrypted files got the ".locked" extension; in the second it was launched from the Documents folder and files got ".locked_wip".
- [15]
"The best opportunity for defenders to detect the attack and prevent encryption is during the threat actor's initial attempts to gain access. Defenders should also prioritize alerts for unauthorized MeshAgent instances or suspicious driver deployment, especially when followed by event-log clearing or recovery tampering, since these early post-compromise behaviors offer the best chance to stop Settra before encryption begins."
- [16]
Settra appears to opportunistically target organizations with unpatched systems and exposed credentials rather than a specific industry, with claimed victims including retail and hospitality, manufacturing and production, professional services, construction and engineering, and food and beverage companies, according to MOXFIVE.
- [17]
Huntress connected the workstation name and C2 IP address from the September incident to previous malicious activity dating back to Dec. 24, 2024.
- [18]
For initial access Settra typically leverages compromised credentials, including VPN credentials, and exploits unpatched software, as previously reported by MOXFIVE and SOCRadar.
- [19]
MeshAgent is an open-source remote device management tool for Windows, Linux, macOS and FreeBSD available on GitHub, with devices managed through a MeshCentral server.
- [20]
"We've seen MeshAgent across many attacks, but it's not one of the most common RMMs Huntress sees being abused. In previous attacks, we've seen threat actors installing renamed malicious MeshAgent instances and using MeshAgent instances to install further RMMs (like ScreenConnect) for persistence."
- [21]
Settra typically communicates with victims for negotiations over Tox chat.
- [22]
A VirusTotal search for the September C2 IP address shows 11 out of 89 security vendors flagging it as malicious.
- [23]
93 claimed victims spread over June to September 2026 is about 23 claimed victims a month.
- [24]
Four leaked victims out of 93 claimed is about 4 percent of the claimed total.
- [25]
11 of 89 VirusTotal vendors flagging the address is about 12 percent of them.
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comNew Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing
1 article · September 18, 2026
- scworld.comSettra ransomware group uses MeshAgent RMM in recent attacks
1 article · September 18, 2026
Topics and entities
Entities
- VirusTotal
- Lindsey O'Donnell-Welch
- Huntress
- SOCRadar
- MeshCentral
- Tox