New GhostFrame Malware Targets VMware ESXi Servers to Steal Credentials and Hijack ...

Researchers have uncovered GhostFrame, a previously undocumented command-and-control (C2) and post-exploitation framework that turns compromised VMware ESXi hosts into platforms for credential theft, virtual machine control, and network intrusion.

Insikt Group’s November 10 report links its use to TAG-218, whose activity overlaps with Settra ransomware . The framework requires existing root access; it does not exploit a vulnerability to enter ESXi.

GhostFrame operates below guest operating systems, allowing attackers to reach multiple virtual machines through one hypervisor. Its recovered web panel contains “Sessions” for managing connected hosts and “Builder” for generating implants.

This centralized approach extends the risks seen in earlier ESXi attacks , without requiring separate malware deployment inside every guest.

New GhostFrame Malware

According to Recorded Future , the builder produces an ELF implant named vmhostd-core, with instructions to compile it, manually disable the ESXi firewall, and execute it from a datastore. The analyzed sample copies itself to /opt/vmhostd-core and modifies /etc/rc.local.d/local.sh to launch automatically.

The altered startup script repeatedly disables the firewall and sets execInstalledOnly to 0, removing restrictions on unsigned binaries approximately every five seconds. Running /sbin/auto-backup.sh preserves configuration changes across reboots. The implant also changes its process name and command-line representation to vmhostd, resembling VMware’s legitimate vmware-hostd daemon.

For C2, GhostFrame simultaneously attempts TCP connections to ports 53, 2222, 3389, 4444, 8443, and 9443 on one server. It retains the first successful connection and closes the others. After thirty seconds without success, it retries following a randomized five-to-twelve-second delay.

Connected implants receive machine code, allocate executable memory, and run payloads without disk writes. If executable memory allocation fails, GhostFrame can instead open a conventional /bin/sh reverse shell.

Operators can list registered VMs, view names and power states, change power settings, and create or delete snapshots. GhostFrame enables VNC access and relays graphical sessions through its infrastructure. It also tunnels the ESXi HTML Host Client and deploys gfsox, a SOCKS5 proxy, for internal network access.

Its sdkmon component is described in the frontend as modifying ESXi service configuration to intercept subsequent login usernames and passwords. Integrated VMkatz supports credential extraction from memory snapshots, virtual disks, combined analysis, or recursive datastore scanning. Targets include NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets, and NTDS.dit.

Between late August and October 2026, TAG-218 infrastructure targeted SonicWall, Palo Alto Networks, and Fortinet VPN appliances across America and Europe. Four organizations later appeared on Settra’s leak site. On October 12, one Fortinet appliance contacted GhostFrame and MeshCentral infrastructure, supporting the connection to previously documented MeshAgent abuse.

The findings align with GlobalProtect exploitation involving CVE-2026-0257, which bypasses authentication and MFA. Unit 42 documented subsequent virtualization-layer access, disabled ESXi controls, and offline credential dumping. GhostFrame’s exclusivity to Settra remains unproven.

Defenders should restrict administrative access, investigate persistence changes, and monitor six-port connection bursts. As with other hypervisor threats , restoring controls alone leaves persistence unresolved.

Indicators include GhostFrame C2 addresses 45[.]158[.]196[.]81 and 45[.]158[.]196[.]141, MeshCentral address 193[.]5[.]65[.]114, and the reported hash a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10. That hash contains only 60 hexadecimal characters, so analysts should verify the complete SHA-256 value before using it for matching.

Note : IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs:

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

Criminal IP Launches New TI Feed App on Splunkbase for Automated Threat Detection

Fortinet2Shell Vulnerability Lets Hackers Execute Code on FortiClient Systems Through Malicious Websites

N-able Warns of Critical N-central Zero-Day Vulnerability Actively Exploited by Hackers

BluePhishing Attack Abuses Microsoft Entra OAuth Consent to Create Hidden AI Agent Identities

Windows Active Directory RCE and DoS Vulnerabilities Put Windows Systems at Risk

Researchers Uncover 45 AI Hacking Frameworks, With Hundreds of Attack Consoles Exposed on the Internet