Settra Ransomware Uses MeshAgent RMM for Persistence

Summary

Settra is a newly identified ransomware variant first observed in June 2026 that gains access through compromised VPNs or stolen credentials. The threat actors deploy MeshAgent RMM for persistence and use Bring Your Own Vulnerable Driver (BYOVD) techniques to evade security controls. After establishing access, they encrypt files, disable recovery options, and clear Windows event logs.

Investigation

Huntress investigated two separate Settra ransomware incidents affecting organizations in the consumer services, retail, and manufacturing sectors. Researchers found that attackers used ransomware executables named after the victim’s domain and relied on MeshAgent RMM for command and control. Analysts also observed attempts to wipe free disk space with the Windows cipher utility and remove recovery partitions using diskpart.

Mitigation

Defenders should prioritize securing remote access points such as VPNs and strengthening credential protections to reduce initial access risk. Monitoring for unauthorized RMM installations and known vulnerable drivers can help identify activity earlier. Organizations should also harden Windows recovery environments and protect event logs from unauthorized tampering.

Response

If Settra activity is detected, affected endpoints should be isolated immediately to stop further encryption and lateral movement. Unauthorized RMM processes such as mvtcs.exe or MeshAgent should be identified and terminated. Responders should also review Windows Event Logs carefully, accounting for attempts to clear records or abuse misspelled log names to evade deletion controls.

Attack Flow

We are still updating this part.

Detections

Suspicious Execution from PerfLogs Directory

Possible MeshAgent Utility Usage Attempt

IOCs (SourceIP) to detect: Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM

SOC Prime AI Rules
18 Sep 2026

IOCs (DestinationIP) to detect: Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access and is preparing the system for a ransomware payload. To ensure the victim cannot easily recover or perform forensics, the attacker executes a series of commands: first, they flush the DNS cache to disrupt any existing connections; second, they disable the Windows Recovery Environment (reagentc) to prevent automated repairs; third, they attempt to overwrite free space using cipher to make data recovery impossible. Finally, they attempt to load a vulnerable driver (gdrv.sys) to escalate privileges to kernel mode. This sequence mirrors the Settra ransomware’s attempt to maximize impact and minimize recovery options.

• # Settra Ransomware Simulation Script
  Write-Host "[!] Starting Settra Ransomware TTP Simulation..." -ForegroundColor Red
  
  # 1. Simulate DNS Cache Flush (T1070.004)
  Write-Host "[*] Executing: ipconfig /flushdns"
  Start-Process cmd.exe -ArgumentList "/c ipconfig /flushdns" -WindowStyle Hidden
  
  # 2. Simulate Disabling Recovery (T1490)
  # Note: Requires Administrator privileges
  Write-Host "[*] Executing: reagentc /disable"
  Start-Process cmd.exe -ArgumentList "/c reagentc /disable" -WindowStyle Hidden
  
  # 3. Simulate Disk Wiping (T1600.002)
  # Note: This is a simulation; we use a dummy path or a non-destructive flag if possible, 
  # but to trigger the rule, we must use 'cipher /w:'
  Write-Host "[*] Executing: cipher /w:C:"
  Start-Process cmd.exe -ArgumentList "/c cipher /w:C:" -WindowStyle Hidden
  
  # 4. Simulate BYOVD Driver Loading (T1068)
  # We simulate the command line used to interact with a driver like gdrv.sys
  Write-Host "[*] Simulating driver interaction with gdrv.sys"
  Start-Process cmd.exe -ArgumentList "/c copy gdrv.sys C:WindowsTempgdrv.sys" -WindowStyle Hidden
  Start-Process cmd.exe -ArgumentList "/c sc create MyVulnerableDriver binPath= C:WindowsTempgdrv.sys type= kernel" -WindowStyle Hidden
  
  Write-Host "[+] Simulation Complete. Check SIEM for alerts." -ForegroundColor Green

• # Cleanup Simulation Artifacts
  Write-Host "[!] Cleaning up simulation..." -ForegroundColor Yellow
  
  # Remove the simulated service
  sc.exe delete MyVulnerableDriver
  
  # Remove the dummy driver file
  Remove-Item -Path "C:WindowsTempgdrv.sys" -ErrorAction SilentlyContinue
  
  # Note: In a real environment, reagentc /enable would be used to restore recovery, 
  # but in a test, ensure the admin restores it manually.
  Write-Host "[+] Cleanup finished. Please ensure Windows Recovery is re-enabled manually if necessary."