Researchers Detail GhostFrame ESXi Implant Linked to Settra Activity
Summary
Insikt Group details GhostFrame, an ESXi post-exploitation framework observed in TAG-218 activity overlapping with Settra ransomware. It requires root access and can persist, control VMs, harvest credentials, and pivot through networks.
Key points
- Insikt Group identified GhostFrame in activity by TAG-218, whose operations overlap with Settra ransomware; the research does not establish that GhostFrame is exclusive to Settra.
- GhostFrame requires existing root-level access to an ESXi host; the implant does not exploit a vulnerability to gain access.
- The implant persists through changes to /etc/rc.local.d/local.sh and /opt/vmhostd-core, and repeatedly disables the ESXi firewall and execInstalledOnly control.
- The analyzed implant attempts near-simultaneous C2 connections over TCP ports 53, 2222, 3389, 4444, 8443, and 9443, then executes received payloads in memory.
- Operators can use GhostFrame to manage hosted VMs, create or delete snapshots, access VM consoles, and tunnel to the ESXi Host Client.
- The framework supports network pivoting through its gfsox SOCKS5 component and credential access through sdkmon and integrated VMkatz capabilities.
- The report recommends restricting and monitoring privileged ESXi access, investigating persistence and security-control changes, and monitoring for GhostFrame’s distinctive multi-port connection pattern.
Article Details
- Attack Vectors
- GhostFrame requires existing root-level access to an ESXi host; the article says the implant does not exploit a vulnerability to gain access.
- TAG-218-targeted VPN appliances, predominantly SonicWall, Palo Alto Networks, and Fortinet devices, across the US and Europe between late August and October 2026. Four targeted organizations were later published on the Settra ransomware leak site.
- The article links the activity to reporting on CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect, but does not establish that TAG-218 exploited this vulnerability.
- Defensive Notes
- Restrict ESXi management access to trusted systems and investigate unexpected privileged access or host changes.
- Monitor for changes to /etc/rc.local.d/local.sh, /opt/vmhostd-core, a vmhostd process, and attempts to disable the ESXi firewall or set execInstalledOnly to 0. Investigate the persistence mechanism rather than only re-enabling controls.
- Monitor for near-simultaneous ESXi TCP connections to the same destination on ports 53, 2222, 3389, 4444, 8443, and 9443.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]5[.]65[.]114 | Identified in the article as TAG-218 MeshCentral C2 infrastructure. |
| IPV4 | 45[.]158[.]196[.]81 | Identified in the article as TAG-218 GhostFrame C2 infrastructure. |
| SHA256 | a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10 | SHA-256 hash of a GhostFrame sample. |
MITRE ATT&CK
T1003.002 · Security Account ManagerVMkatz can extract Security Account Manager data through analysis of VM memory snapshots and virtual disk images.T1003.003 · NTDSVMkatz supports harvesting credential data from NTDS.dit through VM memory or disk analysis.T1003.004 · LSA SecretsVMkatz supports extracting Local Security Authority secrets from hosted Windows systems.T1021.005 · VNCGhostFrame can enable VNC access to individual VMs and relay graphical sessions through its C2 infrastructure.T1036.005 · Match Legitimate Resource Name or LocationThe implant changes its process name and command-line representation to appear as vmhostd, resembling VMware's legitimate vmware-hostd daemon.T1037.004 · RC ScriptsThe implant persists by modifying /etc/rc.local.d/local.sh so the script executes it.T1059.004 · Unix ShellIf executable memory cannot be allocated, the implant can establish a /bin/sh reverse shell.T1090.003 · Multi-hop ProxyThe gfsox SOCKS5 component routes network traffic through a compromised ESXi host for access to internal systems.T1562.004 · Disable or Modify System FirewallThe implant repeatedly disables the ESXi firewall.T1571 · Non-Standard PortThe implant attempts C2 connections across TCP ports 53, 2222, 3389, 4444, 8443, and 9443.T1572 · Protocol TunnelingGhostFrame provides an operator-controlled tunnel to expose the ESXi HTML Host Client through its panel.T1620 · Reflective Code LoadingThe implant receives machine code from C2, allocates executable memory, and runs the payload without writing it to disk.
CVE
Threat Actors
Malware
Vendors
Fortinetthe US and Europe between late August and October 2026, predominantly SonicWall, Palo Alto Networks, and Fortinet devices.Palo Alto Networksappliances across the US and Europe between late August and October 2026, predominantly SonicWall, Palo Alto Networks, and Fortinet devices.SonicWallnetwork (VPN) appliances across the US and Europe between late August and October 2026, predominantly SonicWall, Palo Alto Networks, and Fortinet devices.VMwareGhostFrame is a previously undocumented post-exploitation framework that gives threat actors extensive control over compromised VMware ESXi environments.
Products
ESXiGhostFrame is a previously undocumented post-exploitation framework that gives threat actors extensive control over compromised VMware ESXi environments.GlobalProtectaligns with recent reporting on CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect that allows an attacker to establish a VPN session without valid credentials or multi-factorMeshCentralThese victim-facing servers also connect to TAG-218 tooling, including two GhostFrame C2 servers and a MeshCentral remote monitoring and management server used for persistence that was previously attributed to Settra
Tools
gfsoxFor network pivots, GhostFrame includes a SOCKS5 proxy component named gfsox.GhostFrameGhostFrame is a previously undocumented post-exploitation framework that gives threat actors extensive control over compromised VMware ESXi environments.sdkmonAnalysis of the frontend revealed a component named sdkmon, which the interface describes as a credential interceptor.VMkatzGhostFrame also integrates VMkatz, an open-source credential-harvesting tool.