A newly identified threat known as Settra ransomware has been observed targeting Windows networks by combining two dangerous techniques: misuse of remote administration software and exploitation of vulnerable drivers. Security researchers uncovered two separate breaches—one in July and another in September—each following a similar pattern of attack involving expedited encryption and tactics designed to stymie recovery efforts. Both incidents suggest the attackers gained initial access via virtual private networks or through stolen credentials.
How SETTRA Operates: RMM Tools & Vulnerable Drivers
In both the July and September cases, attackers deployed MeshAgent, a remote monitoring and management (RMM) tool. In the earlier attack, MeshAgent was renamed, then configured to communicate with an attacker-controlled command-and-control server. The ransomware itself was launched from a system performance log directory, encrypted files by appending a custom file extension, and dropped ransom notes titled RESTORE_FILES.txt.
By September, the attackers added another layer—Bring Your Own Vulnerable Driver (BYOVD). This involves loading a legitimate driver known to have security flaws, allowing the threat actors to bypass or disable defensive software. That incident also saw MeshAgent used without renaming, connections to a different control server, execution of ransomware from the Documents folder, and ransom notes placed across various directories.
Disruption of Recovery & Evidence Erasure
Both incidents included steps aimed at undermining recovery and investigation. Attackers cleared Windows Event Logs, disabled the Windows Recovery Environment, and utilized the DiskPart tool to delete recovery partitions. In the July case, free space on a data drive was overwritten using a system utility to thwart data restoration. In contrast, the September attack contained an operational error—the log channel name was mistyped when trying to disable Windows Defender Event Logging—leaving at least one log intact.
Indicators and Defensive Measures
Security analysts have listed a set of observable indicators of compromise (IoCs), including specific IP addresses used as command-and-control servers, file names (such as mvtcs.exe for renamed MeshAgent in July, or driver files like gdrv.sys in September), file extension patterns (e.g., .locked_wip and .locked), and workstation identifiers reused across the incidents.
To protect against similar attacks, organizations should take steps like enforcing strong authentication for VPNs, monitoring and restricting remote-management tools, tracking driver installations, and detecting anomalous processes launched from user or system folders. Maintaining tested offline or air-gapped backups, ensuring recovery environments are operational, and running simulation drills for encryption-based breaches are also emphasized.
This development is concerning precisely because Settra isn’t relying on novel malware—it combines tools that organizations may already have on their networks, misused at a critical time. Attackers are becoming more adept at turning trusted utilities into instruments of destruction. For defenders, this means that even “known” software must be carefully governed, logs must be protected, and recovery plans must be battle-tested.
