Threat Actor
TAG-218
- First Reported
- Nov 10, 2026
- Latest Reported
- Nov 10, 2026
Reported Context (1)
- Insikt Group attributes the observed GhostFrame and MeshCentral infrastructure and VPN-targeting activity to TAG-218; its operations overlap with Settra ransomware activity. Researchers Detail GhostFrame ESXi Implant Linked to Settra Activity
CVE (1)
Malware (1)
MITRE ATT&CK (12)
Vendors (4)
Products (3)
Tools (4)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.