Loading story…
Huntress investigated two Settra ransomware and data-extortion incidents affecting a consumer services and retail organization and a manufacturing company. In both cases, attackers installed MeshAgent remote monitoring and management software for persistence, ran a victim-domain-named ransomware payload ending in _win64.exe, encrypted files, and left RESTORE_FILES.txt ransom notes.
The operators attempted to prevent recovery and hinder forensic investigation by disabling the Windows Recovery Environment, executing DiskPart with a likely recovery-partition removal script, and clearing Windows Event Logs. One intrusion also used the vulnerable gdrv.sys driver, consistent with a bring-your-own-vulnerable-driver technique, while another ran cipher /w to overwrite free disk space and impede recovery of deleted files.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Huntress linked WIN-LIVFRVQFMKO with 193.5.65[.]114 in incidents observed from November 2025 through February 2026.
Huntress observed the workstation name WIN-LIVFRVQFMKO in other incidents dating to December 24, 2024.
The manufacturing-targeting ransomware binary ran reagentc.exe /disable and DiskPart against an unrecovered script, and cleared numerous Windows Event Logs. Its attempt to clear the Windows Defender Operational log failed because it used a misspelled log name.
A Settra incident affected a manufacturing company. The attackers used the gdrv.sys bring-your-own-vulnerable-driver, deployed MeshAgent communicating with 193.5.65[.]114, encrypted files with a .locked_wip extension, and created RESTORE_FILES.txt ransom notes.
During the consumer-services incident, attackers cleared Windows Event Logs, disabled the Windows Recovery Environment, ran DiskPart against an unrecovered script likely targeting a recovery partition, and used cipher /w to overwrite free space on the D: volume.
A Settra incident affected a consumer services and retail organization. Attackers deployed MeshAgent renamed to mvtcs.exe, encrypted files with a .locked extension, and left RESTORE_FILES.txt ransom notes.
Settra, a ransomware and data-extortion variant described as focused on global extortion, was first publicly observed in June.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
Symantec reported that **Trigona** ransomware affiliates used a custom-built data theft utility, `uploader_client.exe`, in recent intrusions, replacing common exfiltration tools such as Rclone and MegaSync. The command-line tool connected to a hardcoded attacker-controlled server and was designed to steal high-value files from network drives, including invoices and PDFs, while lowering detection risk. Reported capabilities included parallel upload streams, TCP connection rotation after large transfers, file-extension filtering, and shared-key authentication, indicating a more mature and deliberate approach to exfiltration by affiliates tied to the **Rhantus** ransomware-as-a-service operation. The attacks also involved a broader toolset to weaken defenses and expand access before data theft. Investigators said the actors attempted to disable security controls with utilities including **HRSword**, **PCHunter**, **Gmer**, **YDark**, **WKTools**, **DumpGuard**, and **StpProcessMonitorByovd**, often abusing vulnerable kernel drivers and using **PowerRun** for elevated execution. They then used **AnyDesk** for remote access and **Mimikatz** plus Nirsoft password recovery tools for credential theft. The activity suggests Trigona, which had lower visibility after disruption in 2023, has remained active and resumed operations with more customized and stealthy tradecraft.
Jun 29, 2026
**Ransomware activity is increasingly blending into normal IT operations** by combining exploitation of internet-facing software with the use of legitimate remote access and monitoring tools. Huntress reported multiple intrusions tied to the **Crazy** ransomware gang where attackers deployed *Net Monitor for Employees Professional* and the *SimpleHelp* remote support client to maintain persistence, evade detection, and stage for ransomware deployment. The actors installed the monitoring agent via `msiexec.exe` directly from the vendor site, then used it for interactive control (desktop viewing, file transfer, command execution); they also added redundant access by installing SimpleHelp via PowerShell and disguising binaries with benign-looking names (e.g., `vshost.exe`) and paths such as `C:\ProgramData\OneDriveSvc\OneDriveSvc.exe`. In parallel, ransomware groups have been observed **actively exploiting recently patched SmarterTools SmarterMail vulnerabilities** that enable unauthenticated compromise of mail servers. SC Media reported that CISA added **CVE-2026-24423** to the KEV catalog after it was linked to ransomware campaigns; the flaw enables unauthenticated RCE via SmarterMail’s `ConnectToHub` API by delivering a malicious OS command from a remote server. A second issue, **CVE-2026-23760**, allows authentication bypass through the password reset API (`force-reset-password`) by not validating the old password; ReliaQuest attributed active exploitation of this weakness to a China-based actor tracked as **Storm-2603**, which reportedly chained the bypass with SmarterMail’s *Volume Mount* feature to reach RCE, activity assessed as staging consistent with **Warlock** ransomware operations (even when ransomware was not yet deployed).
Jun 29, 2026