GhostFrame: A new ESXi Implant Linked to Settra Ransomware​​ ​

GhostFrame is a previously undocumented post-exploitation framework that gives threat actors extensive control over compromised VMware ESXi environments. Once an attacker gains root-level access to an ESXi host, GhostFrame provides a single interface to access virtual machines running on the hypervisor, harvest credentials, execute commands, and pivot deeper into victim networks. Insikt Group identified GhostFrame being used by TAG-218, a threat activity group whose operations overlap with Settra ransomware.​​ ​

GhostFrame is notable because it allows threat actors to operate from the virtualization layer, where a single compromised ESXi host can provide access to multiple virtual machines and the systems and data they contain. Insikt Group’s findings demonstrate how attackers can use compromised hypervisors as a centralized platform for post-exploitation activity, potentially expanding access across victim environments without compromising each virtual machine individually. The discovery highlights the importance of treating virtualization infrastructure as a high-value target and monitoring ESXi hosts for signs of unauthorized access and post-exploitation activity.​​ ​

A New ESXi Post-Exploitation Framework​​ ​

Insikt Group identified GhostFrame, a command-and-control (C2) and post-exploitation framework designed to operate on compromised VMware ESXi hypervisors. GhostFrame provides threat actors with a centralized interface to maintain access to ESXi hosts, execute commands, manage virtual machines (VMs), pivot through internal networks, and harvest credentials from Windows systems hosted on the hypervisor.​​ ​

One notable feature is GhostFrame’s ability to operate from the virtualization layer. A single ESXi host can support multiple VMs running critical services within an organization. GhostFrame allows operators with root privileges on the hypervisor to interact with multiple hosted systems from a single point of access instead of requiring separate access to each guest system.​​ ​

Analysis of GhostFrame’s recovered frontend files revealed a web-based operator panel containing two primary sections: “Sessions” and “Builder.” The builder generates an ESXi implant, while the sessions interface allows operators to monitor connected systems and access the framework’s post-exploitation capabilities.​​ ​

Implant Deployment and Persistence​​ ​

GhostFrame includes an integrated builder that generates an ESXi implant named vmhostd-core . The interface provides operators with deployment instructions, including compiling the binary, manually disabling the ESXi firewall, and executing the implant from a datastore. Operators must already have root-level access to the ESXi host to deploy and execute the implant, as the implant does not exploit a vulnerability to gain access.​​ ​

Analysis of a recovered GhostFrame Executable and Linkable Format (ELF) sample revealed that the implant establishes persistence by copying itself to /opt/vmhostd-core and modifying the ESXi boot script /etc/rc.local.d/local.sh . The modified script executes the implant and repeatedly disables the ESXi firewall and the execInstalledOnly security control, which restricts the execution of unsigned binaries. These commands run approximately every five seconds, allowing the implant to disable the controls again if an administrator attempts to restore them. The implant also executes /sbin/auto-backup.sh to preserve the modified configuration across reboots. To blend into the ESXi environment, the implant appears as vmhostd , a name that resembles VMware’s legitimate vmware-hostd daemon, by modifying its process name and command-line representation.​​ ​

C2 Communications and Payload Execution​​ ​

GhostFrame’s implant uses a distinctive connection strategy to communicate with its C2 server. Rather than relying on a single destination port, the analyzed sample attempts simultaneous Transmission Control Protocol (TCP) connections across six ports: 53, 2222, 3389, 4444, 8443, and 9443. The implant uses the first successful connection for C2 communications and closes the remaining connections. If no connection succeeds within thirty seconds, it retries after a randomized delay between five and twelve seconds. This behavior can produce six near-simultaneous TCP SYN packets from an infected ESXi host to the same destination IP address, providing defenders with a potentially distinctive network detection opportunity.​​ ​

Once connected, the implant functions primarily as an in-memory shellcode loader. It receives machine code from the C2 server, allocates executable memory, and executes the received payload without writing it to disk. If executable memory cannot be allocated, the implant can instead establish a conventional /bin/sh reverse shell.​​ ​

Post-Exploitation Capabilities​​ ​

In addition to maintaining access to the hypervisor, GhostFrame allows operators to interact directly with the VMs hosted on the compromised ESXi system. GhostFrame can enumerate registered VMs, display their names and power states, manipulate VM power states, and create or delete snapshots. It also supports enabling Virtual Network Computing (VNC) access to individual VMs and relaying graphical sessions through the GhostFrame C2 infrastructure to the management panel. This allows operators to interact with the guest VMs without establishing a separate direct connection to the guest system.​​ ​

GhostFrame can also expose the ESXi HTML Host Client through an operator-controlled tunnel, allowing direct access to the hypervisor’s management interface from the GhostFrame panel.​​ ​

For network pivots, GhostFrame includes a SOCKS5 proxy component named gfsox . Once gfsox is deployed to a compromised ESXi host, this component allows operators to route network traffic through the hypervisor, potentially reaching internal systems and services that are otherwise inaccessible from the internet.​​ ​

One of GhostFrame’s more significant capabilities is its integration of multiple credential-access mechanisms. Analysis of the frontend revealed a component named sdkmon , which the interface describes as a credential interceptor. According to the frontend, the component can modify the ESXi service configuration and intercept authentication traffic, allowing it to capture usernames and passwords from subsequent ESXi logins.​​ ​

GhostFrame also integrates VMkatz, an open-source credential-harvesting tool. The interface supports extracting credential data through VM memory snapshots, virtual disk images, combined memory and disk analysis, or recursive scanning of all VMs on a datastore. These methods are associated with NTLM hashes, WDigest credentials, Kerberos tickets, Security Account Manager (SAM) and Local Security Authority (LSA) secrets, and credential data from NTDS.dit .​​ ​

Together, these capabilities suggest that an operator controlling an ESXi host may be able to obtain credentials from hosted Windows systems without first deploying conventional credential-stealing malware inside each VM.​​ ​

GhostFrame’s combination of persistent hypervisor access, remote VM management, network pivoting, and credential harvesting makes it particularly relevant to ransomware and other financially motivated intrusion operations. Its observed use in activity associated with Settra ransomware provides an example of how the framework has been used in the wild.​​ ​

TAG 218: From VPN To Hypervisor​​ ​

Insikt Group identified GhostFrame while monitoring the operator infrastructure behind a threat activity group it designates TAG-218, whose activity overlaps with Settra ransomware operations.​​ ​

Using Recorded Future® Network Intelligence, Insikt Group observed a cluster of victim-facing servers attributed to TAG-218 targeting virtual private network (VPN) appliances across the US and Europe between late August and October 2026, predominantly SonicWall, Palo Alto Networks, and Fortinet devices. Four of the targeted organizations were subsequently published on the Settra ransomware leak site.​​ ​

These victim-facing servers also connect to TAG-218 tooling, including two GhostFrame C2 servers and a MeshCentral remote monitoring and management server used for persistence that was previously attributed to Settra intrusions by Huntress. On October 12, 2026, a victim Fortinet VPN appliance was observed beaconing to both GhostFrame and MeshCentral in the same period, placing GhostFrame within the TAG-218 intrusion chain.​​ ​

This activity aligns with recent reporting on CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect that allows an attacker to establish a VPN session without valid credentials or multi-factor authentication. Palo Alto Networks' updated guidance described a newer post-exploitation technique in which attackers move from a compromised VPN appliance to the virtualization layer and use a custom tool to disable ESXi security controls and harvest credentials, capabilities consistent with those Insikt Group identified in GhostFrame.​​ ​

Insikt Group expects GhostFrame to remain relevant to financially motivated threat actors seeking to capitalize on privileged access to VMware ESXi environments. Its functionality is particularly well-suited for post-exploitation operations with root-level access to an ESXi host. The framework can provide persistence, remote administration, credential access, network pivoting, and control over multiple guest systems from a single interface.​​ ​

Although Insikt Group has observed GhostFrame in association with Settra ransomware, available evidence does not establish that the framework is exclusive to Settra or identify its distribution model. GhostFrame’s ability to convert ESXi access into broader access across virtualized environments makes the framework potentially attractive to other ransomware affiliates and initial access brokers. Insikt Group therefore assesses that it is highly likely that additional financially motivated threat actors will adopt GhostFrame or similar ESXi-focused post-exploitation tooling.​​ ​

Restrict and monitor privileged access to ESXi hosts. GhostFrame requires existing root-level access to deploy and execute the implant, making protection of ESXi administrative access an important barrier to its use. Organizations should limit management access to trusted systems and investigate unexpected privileged access or changes to ESXi hosts.​​ ​

Monitor ESXi hosts for GhostFrame persistence and defense impairment. Defenders should investigate modifications to /etc/rc.local.d/local.sh , the presence of /opt/vmhostd-core or a vmhostd process, and attempts to disable the ESXi firewall or set execInstalledOnly to 0 . Because GhostFrame repeatedly disables these security controls, administrators should investigate the underlying persistence mechanism rather than simply re-enabling the affected settings.​​ ​

Monitor ESXi network traffic for GhostFrame’s distinctive C2 behavior. The analyzed implant attempts near-simultaneous connections to the same destination across TCP ports 53, 2222, 3389, 4444, 8443, and 9443, using the first successful connection for C2 communications. This connection pattern can provide defenders with a behavioral detection opportunity even if GhostFrame operators rotate C2 infrastructure.​​ ​

Get the research from the source. Every month, Insikt Group ® researchers brief a live audience on the threat actors, tools, and infrastructure they’re tracking, and answer your questions.​​ ​

Join the Monthly Briefings​​ ​

Insikt Group 研究を行う際には責任ある開示手続きを遵守しています。​​ ​

Insikt Group ® について​​ ​

Recorded Futureの脅威調査部門であるInsikt Groupは、政府機関、法執行機関、軍、情報機関での豊富な経験を持つアナリストとセキュリティ研究者で構成されています。その使命は、顧客のリスクを軽減し、具体的な成果を可能にし、事業の中断を防ぐような情報を提供することである。​​ ​