New Settra Ransomware Strain Deploys MeshAgent RMM for Persistence
New Settra ransomware strain uses MeshAgent RMM for persistence and advanced evasion techniques.
Researchers have detailed two ransomware incidents involving the new Settra strain, which uses the MeshAgent RMM tool for persistence. Attackers employ tactics like renaming the ransomware to the victim's domain, clearing event logs, disabling recovery environments, and using BYOVD techniques to evade security tools. One incident revealed a typo in the log clearing attempt, inadvertently leaving forensic evidence.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Huntress?
Get an email when a new story names Huntress, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Settra ransomware strain demonstrates how attackers leverage legitimate Remote Monitoring and Management (RMM) tools like MeshAgent to establish persistence, effectively blending into normal IT operations and evading detection. By disabling recovery environments and using Bring Your Own Vulnerable Driver (BYOVD) techniques, attackers ensure victims have limited options for remediation without paying. The deliberate clearing of Windows Event Logs highlights a calculated effort to destroy forensic evidence and hamper incident response — a tactic that ironically backfired in one case due to a typo, underscoring the importance of centralized, tamper-resistant logging. This incident illustrates why organizations must treat RMM tools as high-risk vectors and actively monitor for their unauthorized installation or misuse.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 45.13.122.7
- ip — 193.5.65.114
- malware — Settra
- malware — MeshAgent
- malware — gdrv.sys