> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM - URL: https://f4n6.co.uk/security-feed/ready-settra-go-new-settra-ransomware-variant-deploys-meshagent-rmm/ - Published: 2026-09-22T10:47:52.000Z - Updated: 2026-09-22T10:47:52.000Z - Author: Jeff Davies - Tags: #security-feed, Settra ## 1\. Executive summary Huntress reports two incidents (July and September 2026) in which a new ransomware variant dubbed Settra, first observed in June 2026, was deployed against organisations in the consumer services/retail and manufacturing sectors. Post-compromise activity in both incidents included deployment of the MeshAgent remote monitoring and management (RMM) tool for persistent access, bring-your-own-vulnerable-driver (BYOVD) activity, and extensive anti-recovery and anti-forensics measures including Windows Event Log clearing, disabling the Windows Recovery Environment, and removal of a recovery partition. Files were encrypted with a `.locked` extension and a `RESTORE_FILES.txt` ransom note was dropped. Initial access was not confirmed by Huntress for either incident; public reporting from MoxFive attributes earlier Settra activity to compromised VPNs and use of already-obtained credentials, and SOCRadar describes the group as a ransomware and data-extortion operation. Attribution is unconfirmed: the actor "Settra" has no MITRE ATT&CK profile in our verified reference data, and the IOC set below is single-sourced from the Huntress report. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 18: classification of ICT-related incidents and cyber threats | A ransomware variant with encryption and extortion impact, observed in the wild against enterprise targets, is a cyber threat that financial entities must classify under their incident taxonomy. | Clients whose monitoring surfaces the indicators in §5 should classify the event per their Art. 18 taxonomy and assess whether it meets major-incident thresholds. | | DORA Art. 17: ICT-related incident management process | The observed attack chain includes anti-forensics (event log clearing, recovery partition removal) that directly degrades an entity's ability to investigate and recover, which the incident management process must anticipate. | Verify backup and log-retention designs survive event log clearing and recovery partition deletion; test recovery from the incident management process, not just the backup console. | | NIS2 Art. 23: incident reporting obligations | For in-scope NIS2 entities, a Settra intrusion with encryption would be a reportable security incident with defined notification timelines. | Pre-stage the reporting workflow so classification under Art. 18/23 can complete within the reporting window. | ## 3\. Technical analysis & attack chain This is a threat-campaign item. The confirmed steps below are drawn from the Huntress investigation of two incidents; initial access was not confirmed in either. 1. Initial access: undetermined in both Huntress incidents. Public reporting (MoxFive, 22 July 2026) on earlier Settra activity describes compromised VPNs and use of already-obtained credentials as initial access vectors. Huntress did not confirm these vectors for its two cases. 2. RMM deployment: MeshAgent was installed for persistent access, renamed to `mvtcs.exe` in the July incident, beaconing to C2 IP 45.13.122\[.\]7\. This was among the first EDR detections. 3. BYOVD: Huntress found evidence of bring-your-own-vulnerable-driver activity in both incidents. The specific driver is not named in the source material. 4. Ransomware staging: the ransomware executable was launched from `C:\Perflogs`. In both incidents the executable was named after the victim organisation's domain name with `_win64.exe` appended, indicating per-victim builds or renaming. 5. Encryption and extortion: files were encrypted and renamed with the `.locked` extension; a `RESTORE_FILES.txt` ransom note was created. 6. Anti-recovery and anti-forensics, immediately following ransomware execution: - Cleared several Windows Event Logs. - Ran `reagentc /disable` to disable the Windows Recovery Environment. - Ran `ipconfig /flushdns` to flush the DNS cache. - Ran the native `diskpart` utility via a script to remove a recovery partition. The script itself was not recovered in either incident. Single-sourced caveat: the C2 IP, the `mvtcs.exe` filename, the `.locked` extension, the `RESTORE_FILES.txt` note, the `C:\Perflogs` staging path, and the domain-name-derived executable naming all come from the Huntress report alone. Verify against your own telemetry before enforcing blocks on them. The initial access vectors (VPN compromise, credential reuse) come from MoxFive's public reporting on activity up to mid-July, not from the Huntress incidents, and should be treated as reported for the campaign rather than confirmed for these two cases. SOCRadar characterises Settra as a ransomware and data-extortion group; no public reporting establishes a ransomware-as-a-service model. ## 4\. Mitigation & containment P1 (within 24h): - Block 45.13.122\[.\]7 at the perimeter and hunt retroactively for any outbound connection to it in the last 90 days. Single-sourced IOC; verify before permanent enforcement. - Hunt for MeshAgent or any RMM binary not on your approved software list, specifically `mvtcs.exe` and any MeshAgent installation renamed from its default. RMM tooling outside the approved set is the highest-value detection surface here because it precedes encryption. - Review VPN accounts for impossible-travel logins, dormant credential use, and any MFA bypass or session-token anomalies. Public reporting ties Settra initial access to compromised VPNs and pre-obtained credentials; Huntress did not confirm this for its incidents, but the control is cheap and the exposure is common. - Confirm backups exist that do not depend on the Windows Recovery Environment or an intact recovery partition, since the actor removes both. P2 (within 72h): - Block execution from `C:\Perflogs` via application control policy. It is a staging path in this campaign and has no legitimate executable use. - Alert on `reagentc /disable` and `diskpart` script invocation in any command-line telemetry; both are rare in normal operations and appear in this chain immediately before or after encryption. - Ensure Windows Event Log forwarding to a remote, tamper-resistant sink so local log clearing does not destroy the investigative record. - Review driver loading policy: BYOVD was observed in both incidents. Enforce Microsoft's vulnerable driver blocklist and consider blocking unsigned or newly observed kernel driver loads. P3 (within 7 days): - Validate recovery runbooks against the specific anti-recovery steps in this chain: event log clearing, WinRE disablement, DNS cache flush, and recovery partition removal. Run a recovery test that assumes all four have occurred. - Add MeshAgent and other unapproved RMM tools to the software restriction policy and baseline expected RMM inventory. ## 5\. Indicators of compromise | type | value | confidence | source | | -------------- | ------------------ | ---------------------- | -------- | | ipv4 | 45.13.122\[.\]7 | medium, single-sourced | Huntress | | filename | mvtcs.exe | medium, single-sourced | Huntress | | filename | RESTORE\_FILES.txt | medium, single-sourced | Huntress | | file extension | .locked | medium, single-sourced | Huntress | | filepath | C:\\Perflogs | medium, single-sourced | Huntress | ```iocs ipv4 45.13.122[.]7 filename mvtcs.exe filename RESTORE_FILES.txt file-extension .locked filepath C:\Perflogs ``` No file hashes were published in the source material. The IOC set is single-sourced from the Huntress report; verify before enforcement. Behavioural indicators: | behaviour | where to observe | confidence | | --------------------------------------------------------------------- | ------------------------------------------------------------- | ---------------------------------- | | RMM binary (MeshAgent) renamed and beaconing to external IP | EDR process telemetry, outbound firewall logs | medium | | Ransomware executable named for victim domain with \_win64.exe suffix | EDR process creation events | medium | | Windows Event Log clearing immediately after ransomware execution | EDR, Windows Event Log (Security log clearing, event ID 1102) | medium | | reagentc /disable execution | EDR command-line telemetry | medium | | ipconfig /flushdns execution | EDR command-line telemetry | low, common administrative command | | diskpart run via script to remove recovery partition | EDR command-line telemetry, disk layout changes | medium | ## 6\. Detection ```yara rule RANSOM_Settra_Jul2026 { meta: author = "Adverse Trace" date = "2026-09-22" reference = "https://www.huntress.com/blog/new-settra-ransomware-variant" description = "Detects Settra ransomware artefacts: ransom note filename and encrypted file extension" strings: $note = "RESTORE_FILES.txt" wide ascii $ext = ".locked" wide ascii condition: all of them } ``` ```yaml title: Settra ransomware post-compromise anti-recovery commands id: at-2026-09-22-999-settra-antirecovery status: experimental description: Detects the anti-recovery and anti-forensics command sequence observed in Settra ransomware incidents (reagentc disable, DNS flush, event log clearing). references: - https://www.huntress.com/blog/new-settra-ransomware-variant author: Adverse Trace date: 2026/09/22 logsource: category: process_creation product: windows detection: selection_reagentc: CommandLine|contains: 'reagentc /disable' selection_flushdns: CommandLine|contains: 'ipconfig /flushdns' selection_perflogs: CommandLine|startswith: 'C:\Perflogs' condition: 1 of selection_* falsepositives: - Legitimate administrator recovery reconfiguration - Routine DNS cache clearing by administrators level: high ``` ## 7\. Sources - Huntress, "Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM", https://www.huntress.com/blog/new-settra-ransomware-variant, 17 September 2026 - Cybersecurity Dive, "Settra ransomware variant deployed in recent attacks", https://www.cybersecuritydive.com/news/settra-ransomware-variant-recent-attacks/830787/, September 2026 - MoxFive findings on Settra activity up to mid-July 2026, as cited by Huntress, 22 July 2026 - SOCRadar characterisation of Settra, as cited by Huntress ## 8\. Adverse Trace position We assess Settra as a credible but early-stage ransomware threat: two confirmed incidents, a short operational history since June 2026, and a TTP set (RMM abuse, BYOVD, anti-recovery scripting) that is effective against organisations with weak RMM governance and VPN credential hygiene but not novel. The absence of a MITRE ATT&CK profile for the actor means attribution beyond the "Settra" label is unconfirmed, and the IOC set is single-sourced from Huntress, so we advise verification before enforcement actions. For EMEA financial services the immediate exposure is the initial access pattern reported publicly, compromised VPNs and pre-obtained credentials, which is a control failure any client can test this week regardless of whether Settra reaches their sector. We will monitor for corroborating reporting from additional vendors, additional IOCs, and any confirmation of the initial access vector in the Huntress incidents, and we will reissue this advisory if the picture changes. --- [Read the original source →](https://www.huntress.com/blog/new-settra-ransomware-variant?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*