Skip to navigation

Threat reportMalwareTL-2026-5656

GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware

highACTIVE

Recorded Future's Insikt Group documents GhostFrame, a previously undocumented C2 and post-exploitation framework for compromised VMware ESXi hosts, used by TAG-218 whose activity overlaps with Settra ransomware operations. It requires existing root on the ESXi host and provides VM control, credential harvesting (sdkmon, VMkatz), SOCKS5 pivoting (gfsox) and multi-port C2.

Key facts

IdentifiersTL-2026-5656, CVE-2026-0257
Also known asGhostFrame, vmhostd-core
SeverityHIGH
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2026-0257 (added )
EPSSCVE-2026-0257: 96.8% (99.8th percentile)
Affected productsVMware (Broadcom) ESXi; SonicWall / Palo Alto Networks / Fortinet VPN appliances (reported initial-access targets)
AttributionTAG-218 (medium confidence)
MalwareGhostFrame, Settra
ToolsMeshCentral, VMkatz, VNC
MITRE ATT&CK techniquesT1003.002 Security Account Manager, T1003.003 NTDS, T1003.004 LSA Secrets, T1021.005 VNC, T1036.005 Match Legitimate Resource Name or Location, T1037.004 RC Scripts, T1059.004 Unix Shell, T1078 Valid Accounts, T1090 Proxy, T1133 External Remote Services, T1219 Remote Access Tools, T1490 Inhibit System Recovery and 6 more in the attack flow
MotivationFINANCIAL
Target sectorsretail, manufacturing, enterprise
Target regionsNorth America, Europe
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5656 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GhostFrame ESXi Implant and Tool Artifacts (vmhostd-core, gfsox, sdkmon, VMkatz)

Detects references in forwarded ESXi syslog/shell logs to the GhostFrame implant (/opt/vmhostd-core, vmhostd-core) and its bundled components: gfsox (SOCKS5 pivot proxy), sdkmon (credential interceptor) and VMkatz (VM memory/disk credential harvester). GhostFrame (TAG-218, Settra ransomware overlap) runs at the hypervisor layer so a single hit exposes every guest VM. Requires existing root on the ESXi host; no CVE is exploited.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1036.005, T1059.004, T1003.002, T1003.003, T1003.004
  • Data sources: vmware_esxi_syslog, index=esxi sourcetype=vmw-syslog, Syslog (Microsoft Sentinel), linux syslog
  • Severity: high
  • Confidence: high

Splunk SPL

index=esxi sourcetype=vmw-syslog earliest=-24h ("vmhostd-core" OR "gfsox" OR "sdkmon" OR "vmkatz")
| eval indicator=case(match(_raw,"/opt/vmhostd-core"),"implant_path", match(_raw,"vmhostd-core"),"implant_name", match(_raw,"(?i)vmkatz"),"vmkatz_credential_harvester", match(_raw,"gfsox"),"gfsox_socks5_proxy", match(_raw,"sdkmon"),"sdkmon_credential_interceptor", true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host indicators count first_seen last_seen

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("vmhostd-core", "gfsox", "sdkmon", "vmkatz")
| extend Indicator = case(
    SyslogMessage has "/opt/vmhostd-core", "implant_path",
    SyslogMessage has "vmhostd-core", "implant_name",
    SyslogMessage has "vmkatz", "vmkatz_credential_harvester",
    SyslogMessage has "gfsox", "gfsox_socks5_proxy",
    "sdkmon_credential_interceptor")
| summarize Events = count(), Indicators = make_set(Indicator), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, HostIP
| project Computer, HostIP, Indicators, Events, FirstSeen, LastSeen

Sigma

title: GhostFrame ESXi Implant and Tool Artifacts
id: 5b0e3a1c-7d44-4c1e-9a2f-1e6c5d8a0b11
status: experimental
description: Detects ESXi syslog or shell log entries referencing the GhostFrame implant vmhostd-core and its components gfsox, sdkmon and VMkatz (TAG-218 / Settra ransomware overlap).
references:
    - https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.defense_evasion
    - attack.t1036.005
    - attack.execution
    - attack.t1059.004
    - attack.credential_access
    - attack.t1003.002
    - attack.t1003.003
    - attack.t1003.004
logsource:
    product: linux
    service: syslog
detection:
    keywords:
        - '/opt/vmhostd-core'
        - 'vmhostd-core'
        - 'gfsox'
        - 'sdkmon'
        - 'vmkatz'
    condition: keywords
falsepositives:
    - Security researchers or red teams deliberately staging VMkatz on lab ESXi hosts
    - Documentation or ticket text pasted into an ESXi shell session that mentions the tool names
level: high

Known false positives:

  • Authorized red-team or lab staging of VMkatz on ESXi hosts
  • Admin shell history or notes that mention the tool names

Tuning notes: Requires ESXi shell.log, hostd and auth logs forwarded to Splunk (Splunk Add-on for VMware ESXi Logs) or Sentinel Syslog. Adjust the index name to your environment. Add the implant SHA256 a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10 to FIM/EDR hash hunts where available. Suppress known red-team hosts via a lookup.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ESXi Root SSH Login Followed by VM Control Operations (GhostFrame Operator Activity) · unlock with TL Creds
  • ESXi Firewall Disabled and execInstalledOnly Set to 0 Repeatedly (GhostFrame Defense Impairment) · unlock with TL Creds
  • Connections to TAG-218 GhostFrame C2 Servers [indicator] and [indicator] · unlock with TL Creds
  • ESXi vmhostd Process Masquerade and Shell Fallback (GhostFrame [indicator]) · unlock with TL Creds
  • Settra Ransomware Pre-Encryption Impact Commands (WinRE Disable, Log Clearing, BYOVD [indicator]) · unlock with TL Creds
  • MeshAgent RMM ([indicator]) Beaconing to TAG-218 / Settra MeshCentral Infrastructure · unlock with TL Creds
  • GhostFrame ESXi Boot Persistence via [indicator] and auto-backup.sh · unlock with TL Creds
  • GhostFrame Multi-Port C2 SYN Burst (53/2222/3389/4444/8443/9443) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-5656.

Sample indicators (3 of 18)

  • IP address: 45.158.196[.]81
  • File hash: a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10
  • IP address: 45.158.196[.]141

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

18 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Four targeted organizations were later listed on the Settra leak site.

GhostFrame is a C2 and post-exploitation framework built for compromised VMware ESXi hosts. Its web operator panel has a Sessions view for monitoring connected hosts and a Builder that generates the implant, an ELF binary named vmhostd-core. The framework does not exploit a vulnerability to gain access: it requires existing root on the ESXi host. Because it runs at the hypervisor layer, one compromised host exposes every guest VM.

The implant copies itself to /opt/vmhostd-core and modifies /etc/rc.local.d/local.sh so it runs at boot. The modified script repeatedly (about every five seconds) disables the ESXi firewall and sets execInstalledOnly to 0, which permits unsigned binaries to run, so re-enabling the controls alone does not remediate. /sbin/auto-backup.sh is run to persist the changes across reboots. The process masquerades as vmhostd (resembling VMware's vmware-hostd) by changing its process name and command line.

For C2 the implant opens simultaneous TCP connections to ports 53, 2222, 3389, 4444, 8443 and 9443, keeps the first that succeeds and closes the rest. If nothing connects within 30 seconds it retries after a random 5-12 second delay. Once connected it acts as an in-memory shellcode loader: it receives machine code, allocates executable memory and runs it without writing to disk, and falls back to a /bin/sh reverse shell if executable memory cannot be allocated. The burst of near-simultaneous SYNs to one destination is a network detection signal that survives infrastructure rotation.

Operator capabilities include enumerating VMs and power state, powering VMs on/off, creating and deleting snapshots, enabling VNC on individual VMs and relaying the graphical session through C2, and tunnelling the ESXi HTML Host Client. Components include gfsox (SOCKS5 proxy for pivoting into internal networks), sdkmon (credential interceptor that can modify ESXi service configuration and capture logins) and VMkatz (open-source credential harvester integrated to extract NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets and NTDS.dit data from VM memory snapshots, virtual disks or datastores).

Insikt Group links GhostFrame to TAG-218, whose activity overlaps with Settra ransomware. Two GhostFrame C2 servers and one MeshCentral server were tied to TAG-218 infrastructure; MeshCentral had previously been attributed to Settra intrusions by Huntress (MeshAgent RMM used for persistence). TAG-218 victim-facing servers targeted VPN appliances, mainly SonicWall, Palo Alto Networks and Fortinet, in the US and Europe from late August through October 2026. On 2026-10-12 a victim Fortinet VPN appliance beaconed to both a GhostFrame server and the MeshCentral server, placing GhostFrame in the intrusion chain. Four targeted organizations were later published on the Settra leak site. The source notes the activity aligns with reporting on CVE-2026-0257 (PAN-OS GlobalProtect authentication bypass) but does not confirm that CVE was used, so it is not listed as an exploited CVE here. Settra ransomware (per Huntress) encrypts with .locked/.locked_wip extensions, drops RESTORE_FILES.txt, disables the Windows Recovery Environment, clears event logs and in one case used the gdrv.sys BYOVD driver. BeaconBeagle lookups for the network IOCs returned HTTP 502 during this research, so no C2 correlation could be recorded.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.002 Security Account Manager; T1003.003 NTDS; T1003.004 LSA Secrets

Lateral Movement

T1021.005 VNC

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1620 Reflective Code Loading

Persistence

T1037.004 RC Scripts

Execution

T1059.004 Unix Shell

Initial Access

T1078 Valid Accounts; T1133 External Remote Services

Command and Control

T1090 Proxy; T1219 Remote Access Tools; T1571 Non-Standard Port

Impact

T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1686 Disable or Modify System Firewall

Remediation

Patches

  • Apply the PAN-OS update for CVE-2026-0257 per the Palo Alto Networks advisory where GlobalProtect is deployed

Immediate actions

  • Block 45.158.196.81, 45.158.196.141 and 193.5.65.114 at the perimeter and hunt historical ESXi/VPN egress for them
  • Check ESXi hosts for /opt/vmhostd-core, a vmhostd process, modifications to /etc/rc.local.d/local.sh and an unexpected /sbin/auto-backup.sh
  • Investigate and remove the persistence mechanism instead of only re-enabling the ESXi firewall or execInstalledOnly
  • Alert on near-simultaneous outbound TCP SYNs from ESXi hosts to ports 53, 2222, 3389, 4444, 8443 and 9443 on one destination

Workarounds

  • Where CVE-2026-0257 applies and patching is delayed, disable GlobalProtect authentication override cookies per vendor guidance
  • Block ESXi hosts from initiating outbound internet connections except to approved destinations

Longer-term hardening

  • Restrict and monitor root and management access to ESXi hosts; limit management to trusted systems
  • Forward ESXi logs off-host and alert on firewall disablement and execInstalledOnly changes
  • Harden and patch VPN appliances (SonicWall, Palo Alto Networks, Fortinet) and rotate VPN and ESXi credentials after suspected compromise
  • Rotate credentials that may have been present in VM memory, disks or datastores on compromised hosts

Affected and fixed versions

  • VMware (Broadcom) — ESXi
    Vulnerable versions: Hosts where the attacker already holds root access
  • SonicWall / Palo Alto Networks / Fortinet — VPN appliances (reported initial-access targets)
    Vulnerable versions: Compromised or unpatched appliances; specific versions not stated in source

Timeline

  • Exploitation of PAN-OS GlobalProtect authentication bypass CVE-2026-0257 begins (per Rapid7 via third-party reporting); Insikt notes TAG-218 activity aligns with this reporting but does not confirm the CVE was used.
  • Huntress investigates a Settra ransomware incident (July 2026, exact day not stated) where MeshAgent was renamed locked-ioc-10 and beaconed to locked-ioc-9.
  • Start of the TAG-218 victim-facing server cluster targeting SonicWall, Palo Alto Networks and Fortinet VPN appliances (late August 2026; exact day not stated).
  • Huntress publishes 'Ready, Settra, Go', documenting a September Settra incident with MeshAgent C2 at locked-ioc-8 and locked-ioc-11 BYOVD.
  • A victim Fortinet VPN appliance is observed beaconing to both a GhostFrame C2 server and the MeshCentral server, placing GhostFrame in the intrusion chain.
  • The TAG-218 VPN-targeting cluster ends in October 2026 (exact day not stated); four targeted organizations are later listed on the Settra leak site.

Sources cited

Other reports on CVE-2026-0257

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats