[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdaCbaAC8ZtY__J9qXUGAcfIE7FEmhoowiIPC_CRD2U8":3},{"article":4,"iocs":46,"watch_terms":62,"solutions":63,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"77b10692-55bd-4dc1-932d-13af3efea21b","New Settra Ransomware Strain Deploys MeshAgent RMM for Persistence","new-settra-ransomware-strain-deploys-meshagent-rmm-for-persistence-ebd626","Researchers at Huntress have detailed two ransomware incidents involving Settra, a relatively new strain first observed in June, and revealed a consistent set of post-compromise tactics defenders can use to spot the threat before encryption takes hold. In a blog post published this week, Huntress researchers Harlan Carvey and Lindsey O’Donnell-Welch said the company had […] The post New Settra Ransomware Strain Deploys MeshAgent RMM for Persistence appeared first on IT Security Guru.","Researchers have detailed two ransomware incidents involving the new Settra strain, which uses the MeshAgent RMM tool for persistence. Attackers employ tactics like renaming the ransomware to the victim's domain, clearing event logs, disabling recovery environments, and using BYOVD techniques to evade security tools. One incident revealed a typo in the log clearing attempt, inadvertently leaving forensic evidence.","New Settra ransomware strain uses MeshAgent RMM for persistence and advanced evasion techniques.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F17\u002Fnew-settra-ransomware-strain-deploys-meshagent-rmm-for-persistence\u002F?utm_source=rss&utm_medium=rss&utm_campaign=new-settra-ransomware-strain-deploys-meshagent-rmm-for-persistence","https:\u002F\u002Fwww.itsecurityguru.org\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FChatGPT-Image-Sep-17-2026-05_25_26-PM.png","2026-09-17T16:26:12+00:00","2026-09-17T18:00:12.274621+00:00",8,[17,20],{"name":18,"type":19},"MeshAgent","product",{"name":21,"type":22},"Huntress","vendor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":23,"icon":25,"name":26,"slug":27},null,"Ransomware","ransomware",[29,31,36,41],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54,57,59],{"type":48,"value":49,"context":50},"ip","45.13.122.7","C2 address used by MeshAgent in July incident",{"type":48,"value":52,"context":53},"193.5.65.114","C2 address used by MeshAgent in September incident",{"type":35,"value":55,"context":56},"Settra","New ransomware strain",{"type":35,"value":18,"context":58},"RMM tool deployed for persistence",{"type":35,"value":60,"context":61},"gdrv.sys","BYOVD driver used in September incident",[21,18],{"controls":64,"vendors":150},[65,93,121],{"slug":66,"name":67,"problem":68,"products":69},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[70,77,85],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":66,"product_name":74,"url":75,"description":76},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":94,"name":95,"problem":96,"products":97},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[98,106,113],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":107,"vendor_name":21,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":122,"name":123,"problem":124,"products":125},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",[151],{"slug":107,"name":21,"logo_path":108,"roles":152},[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":173},"settra-ransomware-abuses-rmm-tools-for-persistence-while-sabotaging-recovery","Settra Ransomware Abuses RMM Tools for Persistence While Sabotaging Recovery","The Settra ransomware strain demonstrates how attackers leverage legitimate Remote Monitoring and Management (RMM) tools like MeshAgent to establish persistence, effectively blending into normal IT operations and evading detection. By disabling recovery environments and using Bring Your Own Vulnerable Driver (BYOVD) techniques, attackers ensure victims have limited options for remediation without paying. The deliberate clearing of Windows Event Logs highlights a calculated effort to destroy forensic evidence and hamper incident response — a tactic that ironically backfired in one case due to a typo, underscoring the importance of centralized, tamper-resistant logging. This incident illustrates why organizations must treat RMM tools as high-risk vectors and actively monitor for their unauthorized installation or misuse.",[159,160,161,162,163,164,165,166,167,168,169,170,171,172],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","CIS Control 11: Data Recovery","NIST SP 800-53 AU-9: Protection of Audit Information","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 CP-9: Information System Backup","NIST SP 800-53 SI-3: Malicious Code Protection","NIST Cybersecurity Framework: PR.IP-4 (Backups of information are conducted, maintained, and tested)","NIST Cybersecurity Framework: DE.CM-1 (Network monitoring to detect potential cybersecurity events)","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1070.001: Clear Windows Event Logs","MITRE ATT&CK T1490: Inhibit System Recovery","MITRE ATT&CK T1068: Exploitation for Privilege Escalation (BYOVD)",{"CIS Control 11: Data Recovery":174,"CIS Control 10: Malware Defenses":175,"CIS Control 8: Audit Log Management":176,"NIST SP 800-53 CM-7: Least Functionality":177,"MITRE ATT&CK T1219: Remote Access Software":178,"MITRE ATT&CK T1490: Inhibit System Recovery":179,"NIST SP 800-53 CP-9: Information System Backup":180,"NIST SP 800-53 SI-3: Malicious Code Protection":181,"MITRE ATT&CK T1070.001: Clear Windows Event Logs":182,"NIST SP 800-53 AU-9: Protection of Audit Information":183,"CIS Control 2: Inventory and Control of Software Assets":184,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation (BYOVD)":185,"NIST Cybersecurity Framework: DE.CM-1 (Network monitoring to detect potential cybersecurity events)":186,"NIST Cybersecurity Framework: PR.IP-4 (Backups of information are conducted, maintained, and tested)":187},"Isolated, tested backups ensure recovery is possible even when Settra disables recovery environments.","Anti-malware with protection against vulnerable driver loading helps stop Settra's BYOVD technique and ransomware payload.","Central log collection preserves evidence even when attackers clear local Windows Event Logs.","Least functionality means blocking unneeded software such as unapproved RMM agents and known vulnerable drivers.","Settra abuses legitimate RMM software for persistence, so detecting unapproved remote access tools is key.","Settra inhibits system recovery, so protecting backups and alerting on recovery tampering limits the impact.","Maintaining protected backups gives an alternative to paying when Settra sabotages local recovery options.","Malicious code protection should catch the ransomware and its driver-based attempts to disable defences.","Settra clears Windows Event Logs, so alerting on log clearing and keeping central copies counters this technique.","Protecting audit information, for example by forwarding logs off the host, defeats Settra's log clearing.","An inventory of authorised software makes unapproved RMM tools like MeshAgent visible when Settra installs them for persistence.","BYOVD exploits vulnerable drivers for privilege escalation, so blocking known vulnerable drivers prevents this step.","Network monitoring can reveal MeshAgent connections to attacker infrastructure that blend into normal IT activity.","Backups that are conducted, maintained and tested offline would let victims restore despite Settra disabling recovery."]