Threat video1:00
GhostFrame ESXi Implant of TAG-218: Detection & IOCs
GhostFrame gives an attacker with root on an ESXi host VM control and SOCKS5 pivoting. 9 detection rules, 18 IOCs and a free Splunk SPL rule.
Read the full threat intel for GhostFrame ESXi Implant of TAG-218: Detection & IOCs →
Chapters
- 0:00The hookAbout four firms on Settra's leak.
- 0:04The storyGhostFrame overlaps Settra ransomware.
- 0:11Attack pathIt needs existing root access.
- 0:24AttributionAttributed to TAG-218.
- 0:29Indicators of compromise14 indicators to hunt: 4 IPs, 1 SHA-256 hash and 6 file names, and more.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to impact.
- 0:43Remediation11 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About four firms on Settra's leak.
0:05GhostFrame overlaps Settra ransomware.
0:07Victim Fortinet appliance beaconed to GhostFrame.
0:11It needs existing root access.
0:13Then it deploys vmhostd-core.
0:15It keeps the firewall off.
0:17It races six ports.
0:19It harvests credentials from guest machines.
0:24Attributed to TAG-218. Confidence: medium.
0:3014 indicators to hunt: 4 IPs, 1 SHA-256 hash and 6 file names, and more.
0:3918 ATT&CK techniques, from initial access to impact.
0:4411 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.