SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems

Settra is a human-operated double-extortion ransomware operation first identified in June 2026. Cynet counts 50 to 70+ enterprise victims across technology, manufacturing, financial services, healthcare, and retail, and MOXFIVE case work published July 22 ties initial access to compromised VPN credentials and valid accounts. The chain behind that door is consistent across sources: NetExec and Netscan for discovery, Procdump and Mimikatz against LSASS, PAExec for lateral movement, MeshAgent RMM for persistence, and BYOVD to blind endpoint tooling, using the signed Safetica driver STProcessMonitor_v114.sys and, in Huntress's September incident, gdrv.sys. The payload is a two-stage encryptor: an outer win64.exe loader that refuses to run without an operator --pass argument, hash-resolves APIs through the PEB, stretches the password across roughly 200,000 SHA-256 rounds, and process-hollows a suspended copy of itself to run the inner engine. Cynet's static recovery found no C2 stack and no BCryptDecrypt import, with per-file keys wrapped by an embedded 4096-bit RSA public key, so waiting for a decryption flaw to surface is not a plan.

The damage model is recovery inhibition more than encryption speed. Before touching user files, the inner engine clears 12 event logs with wevtutil, wipes Prefetch and PowerShell history, deletes the NTFS USN journal with fsutil, erases the backup catalog with wbadmin delete catalog, disables WinRE with reagentc /disable, and shrinks VSS shadow storage to 401 MB via vssadmin resize shadowstorage, which forces Windows to silently purge restore points without emitting the shadow-deletion events defenders normally alert on. It also powers off Hyper-V guests over WMI in ROOT\virtualization\v2 to release exclusive .vhdx locks before encrypting the underlying disks. A victim therefore comes out of this with local forensics mostly blind and native rollback gone, shifting the entire response onto off-box log forwarding and immutable backups. This story outranks the day's other ransomware items because the tooling is engineered against exactly the controls smaller organizations lean on, it hides inside legitimate RMM and admin software, and the operator footprint is small: MOXFIVE read the leak-site posting cadence as a crew of only a few people, yet Huntress logged two incidents with near-identical embedded tradecraft, retail in July and manufacturing in September.

Block the known MeshAgent C2 addresses 45.13.122[.]7 and 193.5.65[.]114, flag any MeshAgent binary renamed to mvtcs.exe, and apply Microsoft's recommended driver block rules against STProcessMonitor_v114.sys while alerting on gdrv.sys loads. Hunt for RESTORE_FILES.txt, the C:\Users\Public\NOTICE.png wallpaper and its HKCU\Control Panel\Desktop registry writes, and .locked or .locked_wip extensions, then sweep command-line telemetry for win64.exe --pass, wevtutil cl against Security or System, reagentc /disable, wbadmin delete catalog, vssadmin resize shadowstorage, fsutil usn deletejournal, and cipher /w: runs. One coding error helps defenders: the binary's embedded log list targets Microsoft-Windows-Defender/Operational, but the real path is Microsoft-Windows-Windows-Defender/Operational, so Defender's own operational log survives the wipe and is the first local artifact worth pulling. Enforce phishing-resistant MFA on VPN entry points, run default-deny allowlists for RMM tools, and keep backups offline under separate credentials, since the operators staged exfiltration before encryption through VPN tunnels and tools like rclone.

Watch two developments. New victim postings on Settra's Tor leak blog would confirm the operation is scaling past the incidents Huntress and MOXFIVE have documented, and any reuse of the September infrastructure, the workstation name WIN-LIVFRVQFMKO tied to 193.5.65[.]114 in cases going back to November 2025, links fresh intrusions to the same crew. A shift from the quiet 401 MB shadow-storage resize toward noisy vssadmin delete shadows calls, or new BYOVD drivers beyond STProcessMonitor_v114.sys and gdrv.sys, would signal escalating defense-evasion tooling.