--- schema: 1 kind: threat title: "GhostFrame: Recorded Future's Insikt Group finds an ESXi post-exploitation framework (vmhostd-core implant, VM control panel, VMkatz credential theft) used by TAG-218, whose activity overlaps Settra ransomware and which targeted SonicWall, Palo Alto Networks and Fortinet VPN appliances in the US and Europe" headline: "Insikt: GhostFrame implant re-disables ESXi execInstalledOnly every five seconds and steals guest credentials" summary: > Recorded Future's Insikt Group describes GhostFrame, a command-and-control and post-exploitation framework for VMware ESXi hosts that operators must already hold root on: its vmhostd-core implant persists through ESXi boot scripts, disables the ESXi firewall and the execInstalledOnly control about every five seconds, and a web panel controls guest VMs and runs VMkatz against memory snapshots and virtual disks to recover Windows credentials. Insikt links it to TAG-218, whose activity overlaps Settra ransomware and whose servers targeted SonicWall, Palo Alto Networks and Fortinet VPN appliances in the US and Europe from late August to October 2026. discovered_at: "2026-11-11T03:41:00Z" updated_at: null event_date: "2026-11-10" run_id: 2026-11-11T0256Z-intel priority: notable immediate_action: null tags: [ransomware, organized-crime] regions: [global, us, europe] sectors: [] entities: ["actor:tag-218", "actor:settra", "malware:ghostframe"] techniques: [T1037.004, T1685, T1686, T1036.005, T1620, T1571, T1090, T1021.005, T1003.002, T1003.003, T1003.004] affected_products: ["VMware ESXi"] cves: [] sources: - url: "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware" publisher: "Recorded Future (Insikt Group)" date: "2026-11-10" role: primary - url: "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/" publisher: "Palo Alto Networks Unit 42" date: "2026-10-20" role: corroborating closed_sources: [] evidence: - quote: "Insikt Group identified GhostFrame being used by TAG-218, a threat activity group whose operations overlap with Settra ransomware." publisher: "Recorded Future (Insikt Group)" source_url: "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware" - quote: "Operators must already have root-level access to the ESXi host to deploy and execute the implant, as the implant does not exploit a vulnerability to gain access." publisher: "Recorded Future (Insikt Group)" source_url: "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware" - quote: "These commands run approximately every five seconds, allowing the implant to disable the controls again if an administrator attempts to restore them." publisher: "Recorded Future (Insikt Group)" source_url: "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware" - quote: "targeting virtual private network (VPN) appliances across the US and Europe between late August and October 2026, predominantly SonicWall, Palo Alto Networks, and Fortinet devices." publisher: "Recorded Future (Insikt Group)" source_url: "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware" - quote: "The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer." publisher: "Palo Alto Networks Unit 42" source_url: "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/" verification: single-source sourcing_note: > The GhostFrame behavior and the TAG-218 link rest on Insikt's analysis of recovered operator files, an ELF sample and its network telemetry; Insikt calls the Settra link an overlap, not an identity, and does not say which VPN flaw TAG-218 used. Unit 42 independently describes the same intrusion pattern (VPN gateway to vCenter and ESXi, execInstalledOnly disabled) in separate CVE-2026-0257 cases and Insikt calls that consistent with GhostFrame; neither source says Unit 42's cases used GhostFrame. confidence: high references: ["2026-11-07/kaspersky-esxi-proxmox-ransomware-monitoring-root-password", "2026-11-06/qilin-october-2026-build-vcenter-esxi-safe-mode-printers", "2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen"] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: - "On every ESXi host that sits behind a SonicWall, Palo Alto Networks or Fortinet VPN appliance that was compromised or unpatched since late August, check for an unexpected executable under /opt, a process masquerading as the ESXi host daemon, changes to /etc/rc.local.d/local.sh, and an ESXi firewall or execInstalledOnly setting that switches itself back off, because Insikt reports the implant resets both controls about every five seconds and re-enabling them without removing its persistence is futile." updates: [] migrated_from: null --- Insikt Group describes GhostFrame, a previously undocumented command-and-control and post-exploitation framework for compromised VMware ESXi hosts, which it saw used by TAG-218, a group "whose operations overlap with Settra ransomware" ([Recorded Future, 2026-11-10](https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware)). Operators must already hold root on the host: the implant, an ELF named vmhostd-core generated from a web operator panel, does not exploit a vulnerability to gain access ([Recorded Future, 2026-11-10](https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware)). It copies itself to /opt/vmhostd-core, edits the ESXi boot script /etc/rc.local.d/local.sh and runs /sbin/auto-backup.sh to keep the change across reboots, masquerades as vmhostd (resembling VMware's vmware-hostd), and about every five seconds disables the ESXi firewall and the execInstalledOnly control that restricts execution of unsigned binaries, so an administrator who re-enables them is undone ([Recorded Future, 2026-11-10](https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware)). Its command channel opens simultaneous TCP connections to one address on ports 53, 2222, 3389, 4444, 8443 and 9443, keeps the first that succeeds and retries after a random delay of 5 to 12 seconds, which Insikt notes is a network detection opportunity; the implant is mainly an in-memory shellcode loader with a reverse-shell fallback. From the hypervisor the panel can list registered VMs, change power state, create or delete snapshots, enable VNC on a guest, run a SOCKS5 proxy for pivoting, intercept ESXi logins, and run the open-source VMkatz against VM memory snapshots, virtual disks or whole datastores to recover NTLM hashes, Kerberos tickets, SAM and LSA secrets and NTDS.dit data without running anything inside the guest ([Recorded Future, 2026-11-10](https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware)). Insikt ties TAG-218's victim-facing servers to VPN-appliance targeting across the US and Europe between late August and October 2026, "predominantly SonicWall, Palo Alto Networks, and Fortinet devices", and says four of those organisations later appeared on the Settra leak site; it assesses that other financially motivated actors are highly likely to adopt the framework, which is an assessment, not an observation ([Recorded Future, 2026-11-10](https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware)). Unit 42 independently reports that after CVE-2026-0257 exploitation attackers pivot from the VPN gateway directly to the virtualization layer ([Palo Alto Networks Unit 42, 2026-10-20](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/)). **Exposure:** ESXi hosts whose root credentials, SSH or shell, or vCenter are reachable after an edge compromise; no ESXi vulnerability is involved, so patching ESXi does not address it, and an estate that runs both a SonicWall, Palo Alto Networks or Fortinet VPN appliance and ESXi without isolated hypervisor management is in the pattern Insikt describes. **Detection:** in ESXi file-integrity and shell-audit telemetry, changes to local.sh, a process masquerading as the host daemon or an unexpected executable under /opt, and repeated firewall-off and execInstalledOnly resets; in network telemetry, six near-simultaneous SYNs from the hypervisor management address to one destination on those ports, and any outbound command-style traffic from a hypervisor at all; in vCenter and ESXi logs, snapshot creation or deletion, VNC enablement and power-state changes outside change windows; in datastore telemetry, reads of VM memory-snapshot and virtual-disk files by an identity that is not the backup service. **Triage:** administrators legitimately edit local.sh, create snapshots and use VNC; the discriminators are a firewall-off and execInstalledOnly loop, a binary under /opt named vmhostd where the genuine daemon is vmware-hostd, and snapshot-file reads by a non-backup account. **Defender takeaway:** treat a VPN-appliance compromise as a possible hypervisor compromise and check the ESXi persistence files and the execInstalledOnly state before declaring the incident closed; restrict ESXi and vCenter management to dedicated administration hosts.