Settra Ransomware Variant Targets Organizations with Double Extortion Tactics

• •Settra ransomware employs double extortion tactics, encrypting data and threatening public exposure.
• •Initial access is commonly gained through compromised VPN credentials.
• •Recent attacks utilized RMM tools and left ransom notes, impacting multiple sectors.

Settra, a ransomware variant first identified in June 2026, utilizes double extortion tactics by encrypting data and threatening to publish it if the ransom is not paid. The group has been active since late June, with nearly two dozen victims reported on their leak site. Initial access methods include compromised VPN credentials, allowing attackers to move laterally within victim networks using legitimate administrative tools. Recent incidents involved deploying remote monitoring and management (RMM) tools for persistence and encrypting files while leaving ransom notes. The attacks have affected organizations in various sectors, including consumer services, retail, and manufacturing. Settra's operations appear sporadic, indicating a small team or individual actor behind the attacks. As of September 2026, the threat remains active, with ongoing monitoring by cybersecurity firms.