[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8BBkYXdRuhaF4fgFIvAN8tNb1I1lP6klr7BfdJGkrrw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":41,"created_at":42,"published_at":43,"article":44,"tags":48,"podcasts":67,"controls":68},"3a0d3f8b-85dd-4288-92df-a2ceaee63afe","settra-ransomware-abuses-rmm-tools-for-persistence-while-sabotaging-recovery","77b10692-55bd-4dc1-932d-13af3efea21b","Settra Ransomware Abuses RMM Tools for Persistence While Sabotaging Recovery","The Settra ransomware strain demonstrates how attackers leverage legitimate Remote Monitoring and Management (RMM) tools like MeshAgent to establish persistence, effectively blending into normal IT operations and evading detection. By disabling recovery environments and using Bring Your Own Vulnerable Driver (BYOVD) techniques, attackers ensure victims have limited options for remediation without paying. The deliberate clearing of Windows Event Logs highlights a calculated effort to destroy forensic evidence and hamper incident response — a tactic that ironically backfired in one case due to a typo, underscoring the importance of centralized, tamper-resistant logging. This incident illustrates why organizations must treat RMM tools as high-risk vectors and actively monitor for their unauthorized installation or misuse.","**Immediate actions:**\n- Audit all installed RMM tools across your environment and block unauthorized agents like MeshAgent using application allowlisting.\n- Enable centralized, offsite log aggregation (e.g., a SIEM) so that local event log clearing cannot eliminate forensic evidence.\n- Verify that Windows Recovery Environments and Volume Shadow Copies are intact and protected from unauthorized deletion.\n\n**Long-term improvements:**\n- Implement a formal RMM tool policy that restricts approved vendors, enforces MFA, and requires justification for any new agent deployment.\n- Apply driver allowlisting and Vulnerable Driver Blocklist policies (e.g., Microsoft HVCI) to prevent BYOVD-based security tool evasion.\n- Maintain immutable, offline backups tested regularly for restoration integrity to ensure ransomware cannot eliminate all recovery paths.\n\n**Detection measures:**\n- Create alerting rules for suspicious renaming of executables to match internal domain names, a known Settra obfuscation tactic.\n- Monitor for mass event log clearing commands (e.g., `wevtutil cl`) and treat any such activity as a high-priority incident signal.\n- Deploy behavioral detection controls that flag processes attempting to disable VSS, bcdedit recovery settings, or endpoint security services.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","CIS Control 11: Data Recovery","NIST SP 800-53 AU-9: Protection of Audit Information","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 CP-9: Information System Backup","NIST SP 800-53 SI-3: Malicious Code Protection","NIST Cybersecurity Framework: PR.IP-4 (Backups of information are conducted, maintained, and tested)","NIST Cybersecurity Framework: DE.CM-1 (Network monitoring to detect potential cybersecurity events)","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1070.001: Clear Windows Event Logs","MITRE ATT&CK T1490: Inhibit System Recovery","MITRE ATT&CK T1068: Exploitation for Privilege Escalation (BYOVD)",{"CIS Control 11: Data Recovery":27,"CIS Control 10: Malware Defenses":28,"CIS Control 8: Audit Log Management":29,"NIST SP 800-53 CM-7: Least Functionality":30,"MITRE ATT&CK T1219: Remote Access Software":31,"MITRE ATT&CK T1490: Inhibit System Recovery":32,"NIST SP 800-53 CP-9: Information System Backup":33,"NIST SP 800-53 SI-3: Malicious Code Protection":34,"MITRE ATT&CK T1070.001: Clear Windows Event Logs":35,"NIST SP 800-53 AU-9: Protection of Audit Information":36,"CIS Control 2: Inventory and Control of Software Assets":37,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation (BYOVD)":38,"NIST Cybersecurity Framework: DE.CM-1 (Network monitoring to detect potential cybersecurity events)":39,"NIST Cybersecurity Framework: PR.IP-4 (Backups of information are conducted, maintained, and tested)":40},"Isolated, tested backups ensure recovery is possible even when Settra disables recovery environments.","Anti-malware with protection against vulnerable driver loading helps stop Settra's BYOVD technique and ransomware payload.","Central log collection preserves evidence even when attackers clear local Windows Event Logs.","Least functionality means blocking unneeded software such as unapproved RMM agents and known vulnerable drivers.","Settra abuses legitimate RMM software for persistence, so detecting unapproved remote access tools is key.","Settra inhibits system recovery, so protecting backups and alerting on recovery tampering limits the impact.","Maintaining protected backups gives an alternative to paying when Settra sabotages local recovery options.","Malicious code protection should catch the ransomware and its driver-based attempts to disable defences.","Settra clears Windows Event Logs, so alerting on log clearing and keeping central copies counters this technique.","Protecting audit information, for example by forwarding logs off the host, defeats Settra's log clearing.","An inventory of authorised software makes unapproved RMM tools like MeshAgent visible when Settra installs them for persistence.","BYOVD exploits vulnerable drivers for privilege escalation, so blocking known vulnerable drivers prevents this step.","Network monitoring can reveal MeshAgent connections to attacker infrastructure that blend into normal IT activity.","Backups that are conducted, maintained and tested offline would let victims restore despite Settra disabling recovery.","published","2026-09-17T18:21:03.788604+00:00","2026-09-17T18:21:03.162+00:00",{"id":7,"url":45,"slug":46,"title":47},"https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F17\u002Fnew-settra-ransomware-strain-deploys-meshagent-rmm-for-persistence\u002F?utm_source=rss&utm_medium=rss&utm_campaign=new-settra-ransomware-strain-deploys-meshagent-rmm-for-persistence","new-settra-ransomware-strain-deploys-meshagent-rmm-for-persistence-ebd626","New Settra Ransomware Strain Deploys MeshAgent RMM for Persistence",[49,55,61],{"id":50,"name":51,"slug":52,"description":53,"color":54},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":56,"name":57,"slug":58,"description":59,"color":60},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":62,"name":63,"slug":64,"description":65,"color":66},"c8ff5d73-dec9-4911-88ee-ed016a89f3f4","Backup & Recovery","backup-recovery","No backups, untested recovery, ransomware impact","#f43f5e",[],[69,73,77],{"slug":70,"name":71,"problem":72},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":74,"name":75,"problem":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":78,"name":79,"problem":80},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back."]