Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM | Huntress
Summary
Huntress investigated two confirmed Settra ransomware incidents in July and September 2026 affecting unidentified organizations in consumer services/retail and manufacturing. Initial access was not determined, but both incidents used MeshAgent for remote access, encrypted files, created RESTORE_FILES.txt ransom notes, and attempted to inhibit recovery and erase evidence. The September incident also showed signs of BYOVD using gdrv.sys.
Key points
- Settra ransomware was first observed in June 2026; public reporting cited VPN compromise and previously obtained credentials as possible initial-access methods, but Huntress did not confirm initial access in either incident it investigated.
- In both incidents, the ransomware executable was named after the victim organization's domain with the suffix _win64.exe.
- The July incident used a renamed MeshAgent executable, mvtcs.exe, communicating with 45.13.122[.]7; encrypted files received the .locked extension.
- The September incident used MeshAgent communicating with 193.5.65[.]114 and showed evidence of BYOVD via gdrv.sys; encrypted files received the .locked_wip extension.
- Both attacks created RESTORE_FILES.txt ransom notes, disabled the Windows Recovery Environment with reagentc /disable, used diskpart against an unrecovered script, and attempted to clear Windows Event Logs.
- In the July incident, the attackers also used cipher /w:D:\ to overwrite free disk space and make deleted data harder to recover.
- The September ransomware sample misspelled the Windows Defender event-log channel, leaving the correct Defender Operational log uncleared.
Tags
RansomwareData EncryptionRemote Monitoring and Management AbuseBYOVDDefense EvasionRecovery Inhibition
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]5[.]65[.]114 | MeshAgent command-and-control address in the September incident; also appeared in the MeshAgent certificate information and active endpoint network connections. |
| IPV4 | 45[.]13[.]122[.]7 | MeshAgent command-and-control address in the July incident; the MeshAgent executable was renamed to mvtcs.exe. |
MITRE ATT&CK
T1070.001The ransomware executables cleared multiple Windows Event Logs to hinder forensic investigation.T1219Attackers deployed MeshAgent RMM for persistent remote access in both observed incidents.T1490The ransomware disabled the Windows Recovery Environment and ran diskpart against a script assessed as intended to remove a recovery partition.