Loading story…
Huntress investigated July and September intrusions in which the emerging Settra ransomware operation deployed MeshAgent remote-management software for persistence, then ran ransomware binaries named for the victim domains to encrypt systems. The incidents affected consumer services, retail, and manufacturing organizations, while the group appears to opportunistically target organizations with exposed credentials or unpatched systems rather than a single industry. Settra, active since June 2026, uses double extortion and has claimed 93 victims; previous reporting has associated its access methods with compromised VPNs and stolen credentials.
The operators impaired recovery and forensic response by clearing Windows Event Logs, disabling the Windows Recovery Environment, deleting recovery partitions, and overwriting free disk space. In the September intrusion, they also likely used Gigabyte's vulnerable gdrv.sys driver in a Bring Your Own Vulnerable Driver (BYOVD) attempt to weaken endpoint protections. A typo in the log-clearing command left the Windows Defender Operational log intact, aiding investigators, while infrastructure associated with the campaign has been linked to malicious activity dating to December 2024.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Settra compromised a manufacturing firm, deployed MeshAgent using its default filename, and launched ransomware from the user's Documents folder, encrypting files with .locked_wip. The intrusion showed suspected use of the vulnerable Gigabyte gdrv.sys driver for BYOVD activity; a misspelled log-clearing command left the Windows Defender Operational log intact.
A Settra attack against a consumer services and retail organization deployed MeshAgent, renamed it mvtcs.exe, then executed ransomware from C:\Perflogs. The attackers encrypted files with a .locked extension and impaired recovery by clearing logs, disabling Windows Recovery Environment, removing a recovery partition, and overwriting free space.
Settra ransomware was first observed and became active in June 2026.
The workstation WIN-LIVFRVQFMKO, later linked to the September Settra intrusion, had been associated with IP address 193.5.65[.]114 as early as November 2025.
Huntress linked the September 2026 incident's workstation name and command-and-control IP to malicious activity dating to December 24, 2024.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Huntress investigated two Settra ransomware and data-extortion incidents affecting a consumer services and retail organization and a manufacturing company. In both cases, attackers installed **MeshAgent** remote monitoring and management software for persistence, ran a victim-domain-named ransomware payload ending in `_win64.exe`, encrypted files, and left `RESTORE_FILES.txt` ransom notes. The operators attempted to prevent recovery and hinder forensic investigation by disabling the Windows Recovery Environment, executing DiskPart with a likely recovery-partition removal script, and clearing Windows Event Logs. One intrusion also used the vulnerable `gdrv.sys` driver, consistent with a bring-your-own-vulnerable-driver technique, while another ran `cipher /w` to overwrite free disk space and impede recovery of deleted files.
Sep 17, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
Symantec reported that **Trigona** ransomware affiliates used a custom-built data theft utility, `uploader_client.exe`, in recent intrusions, replacing common exfiltration tools such as Rclone and MegaSync. The command-line tool connected to a hardcoded attacker-controlled server and was designed to steal high-value files from network drives, including invoices and PDFs, while lowering detection risk. Reported capabilities included parallel upload streams, TCP connection rotation after large transfers, file-extension filtering, and shared-key authentication, indicating a more mature and deliberate approach to exfiltration by affiliates tied to the **Rhantus** ransomware-as-a-service operation. The attacks also involved a broader toolset to weaken defenses and expand access before data theft. Investigators said the actors attempted to disable security controls with utilities including **HRSword**, **PCHunter**, **Gmer**, **YDark**, **WKTools**, **DumpGuard**, and **StpProcessMonitorByovd**, often abusing vulnerable kernel drivers and using **PowerRun** for elevated execution. They then used **AnyDesk** for remote access and **Mimikatz** plus Nirsoft password recovery tools for credential theft. The activity suggests Trigona, which had lower visibility after disruption in 2023, has remained active and resumed operations with more customized and stealthy tradecraft.
Jun 29, 2026