Settra Ransomware Uses MeshAgent Persistence and Recovery-Sabotage Tactics

Huntress investigated two Settra ransomware and data-extortion incidents affecting a consumer services and retail organization and a manufacturing company. In both cases, attackers installed MeshAgent remote monitoring and management software for persistence, ran a victim-domain-named ransomware payload ending in _win64.exe, encrypted files, and left RESTORE_FILES.txt ransom notes.

The operators attempted to prevent recovery and hinder forensic investigation by disabling the Windows Recovery Environment, executing DiskPart with a likely recovery-partition removal script, and clearing Windows Event Logs. One intrusion also used the vulnerable gdrv.sys driver, consistent with a bring-your-own-vulnerable-driver technique, while another ran cipher /w to overwrite free disk space and impede recovery of deleted files.