# GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware

> Recorded Future's Insikt Group documents GhostFrame, a previously undocumented C2 and post-exploitation framework for compromised VMware ESXi hosts, used by TAG-218 whose activity overlaps with Settra ransomware operations. It requires existing root on the ESXi host and provides VM control, credential harvesting (sdkmon, VMkatz), SOCKS5 pivoting (gfsox) and multi-port C2. Four targeted organizations were later listed on the Settra leak site.

- **Published:** 2026-11-10T15:15:59Z
- **Last reviewed:** 2026-11-10T15:15:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5656
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5656.png
- **ID:** TL-2026-5656
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TAG-218
- **Detections:** 9 (1 shown free below) · **IOCs:** 18 (3 shown free below)
- **CVEs:** CVE-2026-0257

## Description

GhostFrame is a C2 and post-exploitation framework built for compromised VMware ESXi hosts. Its web operator panel has a Sessions view for monitoring connected hosts and a Builder that generates the implant, an ELF binary named vmhostd-core. The framework does not exploit a vulnerability to gain access: it requires existing root on the ESXi host. Because it runs at the hypervisor layer, one compromised host exposes every guest VM.

The implant copies itself to /opt/vmhostd-core and modifies /etc/rc.local.d/local.sh so it runs at boot. The modified script repeatedly (about every five seconds) disables the ESXi firewall and sets execInstalledOnly to 0, which permits unsigned binaries to run, so re-enabling the controls alone does not remediate. /sbin/auto-backup.sh is run to persist the changes across reboots. The process masquerades as vmhostd (resembling VMware's vmware-hostd) by changing its process name and command line.

For C2 the implant opens simultaneous TCP connections to ports 53, 2222, 3389, 4444, 8443 and 9443, keeps the first that succeeds and closes the rest. If nothing connects within 30 seconds it retries after a random 5-12 second delay. Once connected it acts as an in-memory shellcode loader: it receives machine code, allocates executable memory and runs it without writing to disk, and falls back to a /bin/sh reverse shell if executable memory cannot be allocated. The burst of near-simultaneous SYNs to one destination is a network detection signal that survives infrastructure rotation.

Operator capabilities include enumerating VMs and power state, powering VMs on/off, creating and deleting snapshots, enabling VNC on individual VMs and relaying the graphical session through C2, and tunnelling the ESXi HTML Host Client. Components include gfsox (SOCKS5 proxy for pivoting into internal networks), sdkmon (credential interceptor that can modify ESXi service configuration and capture logins) and VMkatz (open-source credential harvester integrated to extract NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets and NTDS.dit data from VM memory snapshots, virtual disks or datastores).

Insikt Group links GhostFrame to TAG-218, whose activity overlaps with Settra ransomware. Two GhostFrame C2 servers and one MeshCentral server were tied to TAG-218 infrastructure; MeshCentral had previously been attributed to Settra intrusions by Huntress (MeshAgent RMM used for persistence). TAG-218 victim-facing servers targeted VPN appliances, mainly SonicWall, Palo Alto Networks and Fortinet, in the US and Europe from late August through October 2026. On 2026-10-12 a victim Fortinet VPN appliance beaconed to both a GhostFrame server and the MeshCentral server, placing GhostFrame in the intrusion chain. Four targeted organizations were later published on the Settra leak site. The source notes the activity aligns with reporting on CVE-2026-0257 (PAN-OS GlobalProtect authentication bypass) but does not confirm that CVE was used, so it is not listed as an exploited CVE here. Settra ransomware (per Huntress) encrypts with .locked/.locked_wip extensions, drops RESTORE_FILES.txt, disables the Windows Recovery Environment, clears event logs and in one case used the gdrv.sys BYOVD driver. BeaconBeagle lookups for the network IOCs returned HTTP 502 during this research, so no C2 correlation could be recorded.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1620 Reflective Code Loading
- T1037.004 RC Scripts
- T1036.005 Match Legitimate Resource Name or Location
- T1686 Disable or Modify System Firewall
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1021.005 VNC
- T1571 Non-Standard Port
- T1090 Proxy
- T1219 Remote Access Tools
- T1529 System Shutdown/Reboot
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GhostFrame ESXi Implant and Tool Artifacts (vmhostd-core, gfsox, sdkmon, VMkatz)** (`TL-2026-5656-SPL-001`)

Detects references in forwarded ESXi syslog/shell logs to the GhostFrame implant (/opt/vmhostd-core, vmhostd-core) and its bundled components: gfsox (SOCKS5 pivot proxy), sdkmon (credential interceptor) and VMkatz (VM memory/disk credential harvester). GhostFrame (TAG-218, Settra ransomware overlap) runs at the hypervisor layer so a single hit exposes every guest VM. Requires existing root on the ESXi host; no CVE is exploited.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1036.005, T1059.004, T1003.002, T1003.003, T1003.004
- **Data sources:** vmware_esxi_syslog, index=esxi sourcetype=vmw-syslog, Syslog (Microsoft Sentinel), linux syslog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=esxi sourcetype=vmw-syslog earliest=-24h ("vmhostd-core" OR "gfsox" OR "sdkmon" OR "vmkatz")
| eval indicator=case(match(_raw,"/opt/vmhostd-core"),"implant_path", match(_raw,"vmhostd-core"),"implant_name", match(_raw,"(?i)vmkatz"),"vmkatz_credential_harvester", match(_raw,"gfsox"),"gfsox_socks5_proxy", match(_raw,"sdkmon"),"sdkmon_credential_interceptor", true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host indicators count first_seen last_seen
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("vmhostd-core", "gfsox", "sdkmon", "vmkatz")
| extend Indicator = case(
    SyslogMessage has "/opt/vmhostd-core", "implant_path",
    SyslogMessage has "vmhostd-core", "implant_name",
    SyslogMessage has "vmkatz", "vmkatz_credential_harvester",
    SyslogMessage has "gfsox", "gfsox_socks5_proxy",
    "sdkmon_credential_interceptor")
| summarize Events = count(), Indicators = make_set(Indicator), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, HostIP
| project Computer, HostIP, Indicators, Events, FirstSeen, LastSeen
```

### Sigma

```yaml
title: GhostFrame ESXi Implant and Tool Artifacts
id: 5b0e3a1c-7d44-4c1e-9a2f-1e6c5d8a0b11
status: experimental
description: Detects ESXi syslog or shell log entries referencing the GhostFrame implant vmhostd-core and its components gfsox, sdkmon and VMkatz (TAG-218 / Settra ransomware overlap).
references:
    - https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.defense_evasion
    - attack.t1036.005
    - attack.execution
    - attack.t1059.004
    - attack.credential_access
    - attack.t1003.002
    - attack.t1003.003
    - attack.t1003.004
logsource:
    product: linux
    service: syslog
detection:
    keywords:
        - '/opt/vmhostd-core'
        - 'vmhostd-core'
        - 'gfsox'
        - 'sdkmon'
        - 'vmkatz'
    condition: keywords
falsepositives:
    - Security researchers or red teams deliberately staging VMkatz on lab ESXi hosts
    - Documentation or ticket text pasted into an ESXi shell session that mentions the tool names
level: high
```

**Known false positives:**

- Authorized red-team or lab staging of VMkatz on ESXi hosts
- Admin shell history or notes that mention the tool names

**Tuning notes:** Requires ESXi shell.log, hostd and auth logs forwarded to Splunk (Splunk Add-on for VMware ESXi Logs) or Sentinel Syslog. Adjust the index name to your environment. Add the implant SHA256 a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10 to FIM/EDR hash hunts where available. Suppress known red-team hosts via a lookup.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ESXi Root SSH Login Followed by VM Control Operations (GhostFrame Operator Activity) (locked: unlock with TL Creds)
- ESXi Firewall Disabled and execInstalledOnly Set to 0 Repeatedly (GhostFrame Defense Impairment) (locked: unlock with TL Creds)
- Connections to TAG-218 GhostFrame C2 Servers [indicator] and [indicator] (locked: unlock with TL Creds)
- ESXi vmhostd Process Masquerade and Shell Fallback (GhostFrame [indicator]) (locked: unlock with TL Creds)
- Settra Ransomware Pre-Encryption Impact Commands (WinRE Disable, Log Clearing, BYOVD [indicator]) (locked: unlock with TL Creds)
- MeshAgent RMM ([indicator]) Beaconing to TAG-218 / Settra MeshCentral Infrastructure (locked: unlock with TL Creds)
- GhostFrame ESXi Boot Persistence via [indicator] and auto-backup.sh (locked: unlock with TL Creds)
- GhostFrame Multi-Port C2 SYN Burst (53/2222/3389/4444/8443/9443) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 18)

Defanged, TLP:CLEAR.

- IP address: `45.158.196[.]81`
- File hash: `a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10`
- IP address: `45.158.196[.]141`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GhostFrame: A New ESXi Implant Linked to Settra Ransomware](https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware)
- [Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM](https://www.huntress.com/blog/new-settra-ransomware-variant)
- [Palo Alto Networks Security Advisory CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257)
- [CISA Warns of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)](https://threatprotect.qualys.com/2026/06/01/cisa-warns-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257)
- [Horizon3.ai CVE-2026-0257 analysis](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-0257/)
- [Settra ransomware group uses MeshAgent RMM in recent attacks](https://www.scworld.com/news/settra-ransomware-group-uses-meshagent-rmm-in-recent-attacks)
- [New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing](https://infosecurity-magazine.com/news/settra-ransomware-retail)
- [Settra Ransomware Leaves a Defender Log Intact After a Typo](https://blog.gridinsoft.com/settra-ransomware-defender-log-typo/)
- [SOCRadar Settra ransomware group profile](https://socradar.io/free-tools/ransomware-intelligence/groups/settra)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5656