Do Son 
TAG-218 infrastructure (Source: Recorded Future)
TL;DR
Security researchers at Recorded Future uncovered a new post-exploitation tool called the GhostFrame ESXi implant targeting virtualized enterprise infrastructure. Threat actors tracked as TAG-218 deploy the GhostFrame ESXi implant Settra ransomware toolkit after breaching perimeter VPN appliances to control hosted virtual machines from the hypervisor layer. According to Recorded Future, at least four targeted organizations later appeared on the Settra ransomware extortion portal.
Delivery and Attribution
Between late August and October 2026, Recorded Future’s Insikt Group monitored a cluster of attacker servers targeting perimeter VPN appliances across the United States and Europe. Specifically, the intruders focused on SonicWall, Fortinet, and Palo Alto Networks devices. Investigators confirmed that the group behind these servers, designated TAG-218, deployed the GhostFrame ESXi implant during active intrusions. While Insikt Group confirmed TAG-218’s direct use of the malware, researchers assess that the group’s broader relationship with Settra ransomware represents a strong operational overlap rather than exclusive ownership.
Independent reporting from Palo Alto Networks and Huntress reinforces this intrusion pattern. Palo Alto Networks recently warned that attackers exploiting the GlobalProtect authentication bypass flaw (CVE-2026-0257) pivot directly from VPN appliances to the virtualization layer to disable hypervisor protections. Similarly, Huntress previously linked a MeshCentral management server to Settra ransomware attacks. On October 12, 2026, Recorded Future observed a compromised Fortinet VPN appliance communicating with both that exact MeshCentral server and GhostFrame control infrastructure, confirming how the tools work together.
Conceptual Infection Chain
The GhostFrame ESXi implant does not include an exploit to gain initial entry. Instead, an operator must first obtain root privileges on the hypervisor before generating a binary payload through the framework’s web-based builder panel. Once deployed on the host, the ELF binary copies itself to a local system directory and alters the hypervisor’s startup script to survive reboots.
“To blend into the ESXi environment, the implant appears as vmhostd, a name that resembles VMware’s legitimate vmware-hostd daemon, by modifying its process name and command-line representation,” Recorded Future researchers stated. Furthermore, the altered boot script runs a loop every five seconds that turns off the ESXi firewall and disables the security setting that blocks unsigned binaries. Finally, the malware triggers the hypervisor’s built-in backup script to save these weakened settings permanently.
Command-and-Control and Data-Exfiltration Behavior
Once active, the GhostFrame ESXi implant uses a multi-port connection method to reach its command-and-control server. Rather than polling a single port, the malware launches simultaneous TCP connection attempts across six distinct ports: 53, 2222, 3389, 4444, 8443, and 9443. It keeps the first connection that succeeds and closes the remaining five. If all attempts fail within 30 seconds, the implant waits between five and 12 seconds before trying again. Over an active link, the binary works as an in-memory loader that runs received shellcode directly in memory without writing files to disk.
From the central control panel, operators can view all guest virtual machines, change their power states, and manage snapshots. In addition, attackers can turn on Virtual Network Computing (VNC) to view guest desktops or deploy a SOCKS5 proxy module named gfsox to pivot deeper into internal networks. “GhostFrame is notable because it allows threat actors to operate from the virtualization layer, where a single compromised ESXi host can provide access to multiple virtual machines and the systems and data they contain,” the report noted.
To steal sensitive data, the framework combines two credential-harvesting tools. First, a module called sdkmon alters service configurations to intercept usernames and passwords from future ESXi logins. Second, the panel integrates the open-source VMkatz utility to scan virtual machine memory snapshots and disk images. Consequently, attackers can extract Windows NTLM hashes, Kerberos tickets, LSA secrets, and Active Directory domain databases from hosted guest systems without installing malware inside the individual virtual machines.
Defense and Detection Guidance
Defenders can spot the GhostFrame ESXi implant Settra ransomware attack chain by monitoring both hypervisor settings and network traffic. First, administrators should restrict root management access to ESXi hosts and patch perimeter VPN appliances against flaws like CVE-2026-0257. Second, security teams should inspect hypervisor startup scripts for unauthorized changes and watch for rogue processes masquerading as the host daemon. Because the malware disables the ESXi firewall and unsigned binary restrictions every five seconds, repeated configuration changes strongly indicate an active infection. Finally, network defenders should watch for bursts of six simultaneous outbound TCP SYN packets from an ESXi host toward a single external IP address across ports 53, 2222, 3389, 4444, 8443, and 9443.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
