Huntress Details Settra Ransomware Tactics, Including MeshAgent RMM and BYOVD
Summary
Huntress analyzed two Settra ransomware incidents involving MeshAgent for persistence, file encryption, log clearing, and disabled recovery options. One incident also showed BYOVD activity; initial access was not confirmed.
Key points
- Huntress investigated Settra ransomware incidents in July and September 2026 but could not confirm how attackers initially accessed either environment.
- Both incidents used ransomware executables named after the victim organization's domain and deployed MeshAgent RMM for persistent access.
- The attacks encrypted files, created RESTORE_FILES.txt ransom notes, cleared Windows event logs, and disabled recovery options.
- In the July incident, attackers also used cipher to overwrite free disk space; encrypted files used the .locked extension.
- The September incident showed BYOVD activity involving gdrv.sys, and encrypted files used the .locked_wip extension.
- Huntress linked the September activity to a workstation name and IP address observed in previous incidents.
Article Details
- Attack Vectors
- Public reporting described initial access through compromised VPNs or previously obtained credentials; Huntress could not confirm the initial access method in the two incidents it investigated.
- Attackers deployed MeshAgent RMM for persistent access, then launched Settra ransomware executables named after the victim organization's domain with the suffix _win64.exe.
- In the September incident, BYOVD activity involving gdrv.sys was observed.
- Defensive Notes
- Focus on security fundamentals and monitor post-compromise activity, including unauthorized RMM deployment, BYOVD, and attempts to clear Windows Event Logs.
- Monitor for attempts to disable the Windows Recovery Environment, remove recovery partitions, and encrypt files.
- In the September incident, the misspelled log name Microsoft-Windows-Defender/Operational prevented that event log from being cleared.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]5[.]65[.]114 | MeshAgent C2 address in the September Settra incident and previously observed in incidents associated with the malicious workstation. |
| IPV4 | 45[.]13[.]122[.]7 | MeshAgent C2 address in the July Settra incident. |
MITRE ATT&CK
T1070.001 · Clear Windows Event LogsSettra ransomware activity cleared Windows Event Logs in both observed incidents.T1219 · Remote Access ToolsAttackers deployed MeshAgent RMM for persistent access.T1486 · Data Encrypted for ImpactSettra encrypted files, appending .locked or .locked_wip.T1490 · Inhibit System RecoveryThe ransomware disabled the Windows Recovery Environment and attempted to remove recovery partitions.T1561.002 · Disk Structure WipeIn the July incident, the cipher utility overwrote free space on a volume to make deleted data harder to recover.T1562.001 · Disable or Modify ToolsThe September incident included BYOVD activity involving gdrv.sys, described as intended to affect onboard security tooling.
People
Malware
Products
Microsoft Windows(RMM) tools for persistence and then encrypted files, dropped RESTORE_FILES.txt ransom notes, cleared Windows event logs, and disabled Windows recovery options.Windows DefenderOne incident also included signs of Bring Your Own Vulnerable Driver (BYOVD); as well as a notable misspelling by the threat actors during the attack which left them unable to clear the Windows Defender Event Log.
Tools
ciphercmd.exe /c cipher /w:D:\ >nul 2>&1diskpartto disable the Windows Recovery Environment, used ipconfig /flushdns to flush the DNS cache, and ran the diskpart native Window utility via a script to remove a recovery partition (the script could not be recovered inipconfigseveral Windows Event Logs, used reagentc /disable to disable the Windows Recovery Environment, used ipconfig /flushdns to flush the DNS cache, and ran the diskpart native Window utility via a script to remove aMeshAgentHomeBlogReady, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMMreagentcother measures that immediately followed. The threat actor cleared several Windows Event Logs, used reagentc /disable to disable the Windows Recovery Environment, used ipconfig /flushdns to flush the DNS cache,
Industries
consumer services and retailvariant, Settra, was deployed. One incident occurred in July at an organization in the consumer services and retail sector, while the other occurred in September at a company in the manufacturing space.Manufacturingin the consumer services and retail sector, while the other occurred in September at a company in the manufacturing space.