Settra Ransomware Uses MeshAgent and Vulnerable Driver to Evade Defenses

Huntress investigated July and September intrusions in which the emerging Settra ransomware operation deployed MeshAgent remote-management software for persistence, then ran ransomware binaries named for the victim domains to encrypt systems. The incidents affected consumer services, retail, and manufacturing organizations, while the group appears to opportunistically target organizations with exposed credentials or unpatched systems rather than a single industry. Settra, active since June 2026, uses double extortion and has claimed 93 victims; previous reporting has associated its access methods with compromised VPNs and stolen credentials.

The operators impaired recovery and forensic response by clearing Windows Event Logs, disabling the Windows Recovery Environment, deleting recovery partitions, and overwriting free disk space. In the September intrusion, they also likely used Gigabyte's vulnerable gdrv.sys driver in a Bring Your Own Vulnerable Driver (BYOVD) attempt to weaken endpoint protections. A typo in the log-clearing command left the Windows Defender Operational log intact, aiding investigators, while infrastructure associated with the campaign has been linked to malicious activity dating to December 2024.