Tool
diskpart
- First Reported
- Sep 17, 2026
- Latest Reported
- Oct 12, 2026
Reported Context (2)
- showed MeshAgent staging followed by ransomware child processes that invoked reagentc.exe /disable and diskpart scripts assessed to remove recovery partitions, while encrypting files with a .locked_wip extension. Ransomware Disclosures Fell to 862 in September as Affiliates Continued Evolving Their Tactics
- to disable the Windows Recovery Environment, used ipconfig /flushdns to flush the DNS cache, and ran the diskpart native Window utility via a script to remove a recovery partition (the script could not be recovered in Huntress Details Settra Ransomware Tactics, Including MeshAgent RMM and BYOVD
CVE (5)
Malware (2)
People (4)
Threat Actors (33)
MITRE ATT&CK (6)
Vendors (6)
Products (17)
Tools (18)
Industries (11)
Countries (8)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.