Threat Summary
The pulse describes Settra, a ransomware variant first observed in June 2026, with investigated intrusions in July and September 2026 impacting consumer services, retail, and manufacturing. Initial access is consistent with external remote services and valid accounts: VPN exposure, compromised credentials, or both. After entry, operators deploy MeshAgent/MeshCentral-style RMM tooling for interactive access and persistence, then stage ransomware executables named after victim domain names to blend in with the host identity. Reported behaviors include file encryption, recovery inhibition, and BYOVD-style defense impairment, indicating an intrusion set optimized for rapid enterprise-wide denial rather than quiet data theft alone.
The collective signal is a hands-on ransomware operation that abuses legitimate remote administration tooling to reduce malware footprint, moves from edge access to domain-level execution, and deliberately destroys recovery options before or during encryption. The objective is high-pressure extortion: inhibit backup restoration, disable defensive visibility with vulnerable drivers where possible, and maximize operational disruption across retail and manufacturing environments where downtime tolerance is low.
Threat Actor / Malware Profile
Settra ransomware is the encryption payload. Victim-specific naming of executables after domain names suggests post-compromise reconnaissance and customization rather than fully automated mass deployment. Expected behaviors include mass file encryption, ransom note creation, shadow copy deletion, boot recovery tampering, and possible stop conditions for scoped targeting.
MeshAgent / MeshCentral RMM is used as a persistence and command conduit. RMM abuse provides interactive keyboard access, file transfer, service creation, and remote shell capability while often evading controls tuned only for commodity malware. Look for agent installation directories, services with Mesh/MeshAgent naming, outbound TLS to RMM infrastructure, and process trees where meshagent.exe spawns shells, scripting engines, ransomware binaries, or enumeration tools.
Initial access and identity path: VPN access, exposed remote services, weak MFA coverage, and reused or compromised credentials are the likely control failures. This maps to external remote services and valid-account usage rather than a novel exploit chain.
Execution chain: edge/VPN access → credential validation → RMM deployment → discovery and privilege checks → optional vulnerable driver load for defense impairment → backup/catalog deletion → ransomware launch using domain-named executable → ransom note and recovery inhibition.
Anti-analysis and evasion: living-off-the-land commands (vssadmin, wbadmin, bcdedit), legitimate signed RMM binaries, possible BYOVD driver loading to blind EDR, victim-specific file naming, and infrastructure that may resemble normal remote support traffic.
IOC Analysis
The supplied OTX sample reports zero visible indicators and notes that indicators are restricted in the original pulse. SOC teams should therefore treat this as a behavior-led hunt, not an IOC sweep. Pull the referenced Huntress research and original OTX pulse for any hashes, C2 domains, installer names, mutexes, ransom note names, driver hashes, and victim-specific artifacts, then operationalize in this order:
- File hashes: add to EDR block lists and retro-hunt for execution and file-write events across endpoints and servers.
- Domains/IPs: enforce DNS, proxy, firewall, and TLS inspection blocks; identify first-seen connections and netflow outliers.
- URLs/install paths: search software inventory, browser downloads, email detonation, and RMM deployment logs.
- Named artifacts: hunt for executables matching
<domain>.exe, MeshAgent services, unexpected drivers in temp/user paths, and ransom-note extensions.
Useful tooling: EDR advanced hunting, Sysmon/Windows Eventing, Sigma pipelines, Velociraptor or KAPE for triage, YARA for payload families, MISP/OpenCTI for indicator management, and firewall/DNS logs for RMM egress.
Detection Engineering
Sigma Detection Pack
---
title: Settra Ransomware Recovery Inhibition Commands
id: 8f1f5b7a-3c9d-4f0e-a8d1-settra0001
status: experimental
description: Detects shadow copy, backup catalog, and boot recovery tampering associated with Settra-style ransomware recovery inhibition.
author: Security Arsenal
logsource:
category: process_creation
product: windows
detection:
sel_img:
Image|endswith:
- '\vssadmin.exe'
- '\wbadmin.exe'
- '\bcdedit.exe'
- '\powershell.exe'
- '\cmd.exe'
sel_cmd:
CommandLine|contains:
- 'delete shadows'
- 'shadowcopy delete'
- 'delete catalog'
- 'recoveryenabled no'
- 'bootstatuspolicy ignoreallfailures'
- 'resize shadowstorage'
condition: sel_img and sel_cmd
falsepositives:
- Legitimate backup maintenance windows
- System administrator disaster recovery testing
level: high
tags:
- attack.t1490
- attack.t1562
- attack.impact
date: 2026/10/17
modified: 2026/10/17
---
title: MeshAgent RMM Install or Service Execution
id: 8f1f5b7a-3c9d-4f0e-a8d1-settra0002
status: experimental
description: Detects MeshAgent/MeshCentral RMM service creation, installation, or suspicious child processes consistent with Settra intrusions.
author: Security Arsenal
logsource:
category: process_creation
product: windows
detection:
sel_mesh:
Image|contains:
- 'meshagent'
- 'meshcentral'
OriginalFileName|contains:
- 'MeshAgent'
- 'MeshCentral'
CommandLine|contains:
- 'meshagent'
- '-install'
- 'fullinstall'
sel_child:
ParentImage|contains:
- 'meshagent'
- 'meshcentral'
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\rundll32.exe'
- '\wmic.exe'
- '\psexec.exe'
sel_svc:
Image|endswith: '\sc.exe'
CommandLine|contains|all:
- 'create'
- 'mesh'
condition: sel_mesh or sel_child or sel_svc
falsepositives:
- Authorized MeshCentral deployment by IT
- Managed service provider remote support tooling
level: medium
tags:
- attack.t1219
- attack.t1543.003
- attack.command-and-control
date: 2026/10/17
modified: 2026/10/17
---
title: Suspect BYOVD Driver Load From User-Writable Path
id: 8f1f5b7a-3c9d-4f0e-a8d1-settra0003
status: experimental
description: Detects driver service creation or driver load from temp/user/profile paths, a BYOVD pattern used to impair EDR before ransomware detonation.
author: Security Arsenal
logsource:
category: process_creation
product: windows
detection:
sel_sc:
Image|endswith:
- '\sc.exe'
- '\rundll32.exe'
- '\pnputil.exe'
CommandLine|contains:
- ' type= kernel'
- 'binPath='
- '.sys'
sel_path:
CommandLine|contains:
- '\AppData\Local\Temp\'
- '\Users\Public\'
- '\ProgramData\'
- '\Windows\Temp\'
condition: sel_sc and sel_path
falsepositives:
- Hardware vendors installing drivers from temporary extraction paths
- Rare enterprise software packaging
level: high
tags:
- attack.t1068
- attack.t1562.001
- attack.t1543.003
date: 2026/10/17
modified: 2026/10/17
Microsoft Sentinel KQL
let Lookback = 14d;
let DomainName = "<your-domain-name>";
union isfuzzy=true
(
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName =~ "meshagent.exe"
or FileName =~ "meshcentral.exe"
or ProcessCommandLine has_any ("meshagent","meshcentral","fullinstall","-install")
or (FileName =~ strcat(DomainName, ".exe"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
),
(
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName in~ ("vssadmin.exe","wbadmin.exe","bcdedit.exe")
or ProcessCommandLine has_any ("delete shadows","shadowcopy delete","delete catalog","recoveryenabled no","bootstatuspolicy ignoreallfailures","resize shadowstorage")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
),
(
DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where InitiatingProcessFileName =~ "meshagent.exe"
or InitiatingProcessFileName =~ "meshcentral.exe"
or RemoteUrl has_any ("meshcentral","meshagent")
or (RemotePort in (443,80,8080,16992,16993) and InitiatingProcessFileName =~ strcat(DomainName, ".exe"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine
),
(
DeviceEvents
| where TimeGenerated >= ago(Lookback)
| where ActionType has_any ("ServiceInstalled","DriverLoad")
or AdditionalFields has_any (".sys","meshagent","kernel")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, AdditionalFields
)
| sort by TimeGenerated desc
PowerShell Host Hunt
# Read-only hunt for Settra/MeshAgent behaviors. Run elevated in triage; review before remediation.
$domain = ($env:USERDNSDOMAIN); if ([string]::IsNullOrWhiteSpace($domain)) { $domain = $env:COMPUTERNAME }
$domainExe = ($domain.Split('.')[0] + '.exe').ToLower()
$suspectPaths = @($env:TEMP, "$env:LOCALAPPDATA\Temp", "$env:PUBLIC", "$env:ProgramData", "$env:windir\Temp")
Write-Host "[+] Services matching Mesh/RMM or odd kernel drivers"
Get-CimInstance Win32_Service | Where-Object {
$_.Name -match 'mesh|agent|rmm|remote' -or $_.DisplayName -match 'mesh|agent|rmm|remote' -or $_.PathName -match '\.sys|AppData|ProgramData|Temp|Users\\Public'
} | Select-Object Name, DisplayName, State, StartMode, PathName
Write-Host "[+] Running processes of interest"
Get-CimInstance Win32_Process | Where-Object {
$_.Name -match 'meshagent|meshcentral|vssadmin|wbadmin|bcdedit' -or $_.Name.ToLower() -eq $domainExe -or
($_.CommandLine -match 'delete shadows|shadowcopy delete|delete catalog|recoveryenabled no|bootstatuspolicy ignoreallfailures|meshagent')
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine, ParentProcessId
Write-Host "[+] Recent executables/drivers in user-writable paths"
foreach ($p in $suspectPaths) {
if (Test-Path $p) {
Get-ChildItem $p -Recurse -Force -ErrorAction SilentlyContinue |
Where-Object { $_.Extension -in '.exe','.dll','.sys' -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
Select-Object FullName, Length, CreationTime, LastWriteTime
}
}
Write-Host "[+] Run keys and scheduled tasks referencing mesh/rmm/domain-named payloads"
$runKeys = @('HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) { if (Test-Path $k) { Get-ItemProperty $k | Select-Object PSPath, * } }
Get-ScheduledTask | Where-Object { ($_.TaskName -match 'mesh|agent|rmm') -or ($_.Actions.Execute -match 'mesh|AppData|ProgramData|Temp|Users\\Public') } | Select-Object TaskName, TaskPath, State
Write-Host "[+] Network listeners/connections from suspicious processes"
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
if ($proc -and ($proc.ProcessName -match 'mesh|agent|rmm' -or $proc.Path -match 'AppData|ProgramData|Temp|Users\\Public')) {
[pscustomobject]@{ LocalAddress=$_.LocalAddress; LocalPort=$_.LocalPort; RemoteAddress=$_.RemoteAddress; RemotePort=$_.RemotePort; Process=$proc.ProcessName; Path=$proc.Path }
}
}
Write-Host "[+] Shadow copy state"
vssadmin list shadows
bcdedit /enum {current} | Select-String -Pattern 'recoveryenabled|bootstatuspolicy'
Response Priorities
- Immediate: isolate hosts with MeshAgent not approved by IT, disable/uninstall unauthorized RMM, block RMM egress by DNS/proxy/firewall, deny domain-named executables and vulnerable driver loads, and hunt for
vssadmin,wbadmin,bcdedit,sc create, service installs, and.sysfiles in user-writable paths. Verify backups are offline/immutable before attacker discovery. - 24 hours: because initial access involves VPN or compromised credentials, force enterprise-wide credential resets for affected users/admins, revoke sessions/tokens, enforce phishing-resistant MFA on VPN and remote admin planes, audit VPN logs for impossible travel and first-time devices, and review privileged group changes, new local admins, GPO edits, and RMM consent prompts.
- 1 week: harden edge access with VPN certificate/device checks and conditional access, restrict RMM to an approved allowlist with egress pinning, deploy application control for user-writable directories, enable vulnerable driver blocklist, separate backup identities from domain admin, test restore speed for retail/manufacturing operations, and add tabletop coverage for ransomware with recovery inhibition.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.