GhostFrame: Recorded Future's Insikt Group finds an ESXi post-exploitation framework (vmhostd-core implant, VM control panel, VMkatz credential theft) used by TAG-218, whose activity overlaps Settra ransomware and which targeted SonicWall, Palo Alto Networks and Fortinet VPN appliances in the US and Europe

Insikt Group describes GhostFrame, a previously undocumented command-and-control and post-exploitation framework for compromised VMware ESXi hosts, which it saw used by TAG-218, a group "whose operations overlap with Settra ransomware" (Recorded Future, 2026-11-10). Operators must already hold root on the host: the implant, an ELF named vmhostd-core generated from a web operator panel, does not exploit a vulnerability to gain access (Recorded Future, 2026-11-10). It copies itself to /opt/vmhostd-core, edits the ESXi boot script /etc/rc.local.d/local.sh and runs /sbin/auto-backup.sh to keep the change across reboots, masquerades as vmhostd (resembling VMware's vmware-hostd), and about every five seconds disables the ESXi firewall and the execInstalledOnly control that restricts execution of unsigned binaries, so an administrator who re-enables them is undone (Recorded Future, 2026-11-10). Its command channel opens simultaneous TCP connections to one address on ports 53, 2222, 3389, 4444, 8443 and 9443, keeps the first that succeeds and retries after a random delay of 5 to 12 seconds, which Insikt notes is a network detection opportunity; the implant is mainly an in-memory shellcode loader with a reverse-shell fallback.

From the hypervisor the panel can list registered VMs, change power state, create or delete snapshots, enable VNC on a guest, run a SOCKS5 proxy for pivoting, intercept ESXi logins, and run the open-source VMkatz against VM memory snapshots, virtual disks or whole datastores to recover NTLM hashes, Kerberos tickets, SAM and LSA secrets and NTDS.dit data without running anything inside the guest (Recorded Future, 2026-11-10). Insikt ties TAG-218's victim-facing servers to VPN-appliance targeting across the US and Europe between late August and October 2026, "predominantly SonicWall, Palo Alto Networks, and Fortinet devices", and says four of those organisations later appeared on the Settra leak site; it assesses that other financially motivated actors are highly likely to adopt the framework, which is an assessment, not an observation (Recorded Future, 2026-11-10). Unit 42 independently reports that after CVE-2026-0257 exploitation attackers pivot from the VPN gateway directly to the virtualization layer (Palo Alto Networks Unit 42, 2026-10-20).

Triage: administrators legitimately edit local.sh, create snapshots and use VNC; the discriminators are a firewall-off and execInstalledOnly loop, a binary under /opt named vmhostd where the genuine daemon is vmware-hostd, and snapshot-file reads by a non-backup account.