Key Takeaways

  • Security researchers found Settra using MeshAgent for persistent remote access in two separate ransomware incidents.
  • The attacks combined log deletion and recovery sabotage, with one also deploying the gdrv.sys vulnerable driver.
  • Unexpected RMM installations and changes to Windows recovery settings may provide warning before encryption occurs.

Security researchers at Huntress have documented a repeatable post-compromise playbook used by Settra, a ransomware strain first observed in June. The findings come from two incidents investigated since July, including an attack on a consumer services and retail organization and a September compromise affecting a manufacturing firm.

Huntress could not determine the initial access method in either incident. Earlier reporting from MoxFive, however, connected Settra activity with compromised VPNs and stolen credentials. In the September case, the endpoint agent was installed only after the environment had been breached, raising the possibility that the attacker remained active while monitoring began.

In both incidents, the attackers deployed MeshAgent, a legitimate remote monitoring and management (RMM) client, to preserve hands-on-keyboard access. They also named the ransomware executable after the victim’s domain and appended "_win64.exe," giving defenders a potentially useful pattern to search for across endpoints and file telemetry.

During the July attack, MeshAgent was renamed mvtcs.exe and connected to 45.13.122[.]7. One day later, the ransomware launched from C:\Perflogs, encrypted files with the ".locked" extension, and created a ransom note called RESTORE_FILES.txt.

The attackers then tried to undermine investigation and recovery. They cleared multiple Windows Event Logs, flushed the DNS cache, and disabled the Windows Recovery Environment using the reagentc /disable command. They also used diskpart to remove a recovery partition and ran the native Windows cipher utility to overwrite free disk space. That last step can substantially reduce the prospects of recovering deleted material.

The September intrusion followed the same outline, with specific tactical shifts. MeshAgent retained its original name and communicated with 193.5.65[.]114, which analysts found in certificate metadata and active endpoint connections. The ransomware ran from the compromised user’s Documents folder, while affected files received the ".locked_wip" extension.

Investigators also found gdrv.sys, indicating Bring Your Own Vulnerable Driver (BYOVD) activity. BYOVD attacks take advantage of legitimate but vulnerable kernel drivers to interfere with endpoint security. An attacker gains durable remote access through accepted administration software, then attempts to blind the controls that could reveal or interrupt that access.

RMM software is common in managed environments, making its presence less likely to trigger immediate alerts. Industry data from a 2026 cyber threat report found that abuse of RMM tools increased 277% year over year in 2025 and represented approximately 24% of observed cyber incidents.

MeshAgent has become particularly visible in that shift. The Acronis Threat Research Unit recorded 1,178 MeshAgent-related security incidents between September 2025 and March 2026, with malicious installations outnumbering legitimate ones by almost eight to one. Other ransomware operations, including Anubis, Medusa, and Agenda/Qilin, have similarly incorporated remote-access products such as AnyDesk, ConnectWise ScreenConnect, SimpleHelp, and MeshAgent into their workflows.

One small attacker error helped investigators. Settra attempted to erase twelve Windows Event Logs during the September incident but misspelled one target as "Microsoft-Windows-Defender/Operational" instead of "Microsoft-Windows-Windows-Defender/Operational." The failed command preserved additional forensic evidence.

Analysts also associated the attack with a workstation called WIN-LIVFRVQFMKO. The team had seen that system in unrelated incidents dating to December 2024 and linked it to the 193.5.65[.]114 IP address as far back as November 2025. Infrastructure reuse offers investigators a promising pivot, though attribution remains unsettled.

There is currently no public evidence that Settra operates as ransomware-as-a-service. Even so, its methods resemble broader ransomware tradecraft more than a unique technical model. Crux, KawaLocker, and Cephalus are among the other emerging strains tracked by the security operations center this year.

For enterprises, the practical response extends beyond blocking individual indicators. Access policies based on NIST SP 800-207 Zero Trust Architecture can help restrict RMM use according to identity, device, and context. Security teams can also inventory approved remote-management clients, alert on new installations, monitor vulnerable driver loading, and protect logs from deletion. Commands that disable recovery, remove partitions, or overwrite free space require immediate investigation, particularly when they appear alongside unusual RMM traffic.