---
title: Settra-Linked GhostFrame Kit Pulls Windows Passwords From ESXi
description: Recorded Future researchers tied the hypervisor toolkit to TAG-218, which went after US and European VPN gear from late August through October.
canonical_url: https://codekeeper.co/ticker/settra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi
---

[Ransomware](https://codekeeper.co/ticker/tag/ransomware) | [Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Settra-Linked GhostFrame Kit Pulls Windows Passwords From ESXi

Recorded Future researchers tied the hypervisor toolkit to TAG-218, which went after US and European VPN gear from late August through October.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 11, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

On November 10, 2026, Recorded Future’s Insikt Group detailed GhostFrame, a new control panel and implant for VMware ESXi hypervisors. TAG-218, a group whose activity overlaps with Settra ransomware, uses it. GhostFrame exploits no bug, so operators need root on the host first. One panel can then switch off, snapshot, or remotely view the host’s VMs. Its credential theft stands out. A module called sdkmon is built to capture later ESXi logins, and the bundled open-source VMkatz can pull NTLM hashes, Kerberos tickets, and NTDS.dit data from VM memory snapshots and disks, with no malware inside Windows guests. The implant also kills the ESXi firewall and execInstalledOnly about every five seconds, undoing admin fixes. From late August to October 2026, TAG-218 servers targeted mostly SonicWall, Palo Alto Networks, and Fortinet VPN devices in the US and Europe, and four of the targeted organizations later appeared on Settra’s leak site. Insikt says other financially motivated groups will highly likely pick up GhostFrame or similar tools, and advises locking down ESXi management access, checking /etc/rc.local.d/local.sh, and flagging hosts that fire six near-simultaneous connections at one address. Source: [Cybersecurity News](https://cybersecuritynews.com/ghostframe-malware-hijack-vmware-esxi/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsettra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks OpsShield Hit by Supply Chain Attack, Nearly 3,000 Servers Compromised Nov 5, 2026](https://codekeeper.co/ticker/opsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised)

[Cyberattacks Qilin and Inc Abuse Palo Alto VPN Flaw to Skip MFA and Raid VMware Oct 21, 2026](https://codekeeper.co/ticker/ransomware-exploits-palo-alto-vpn-vulnerability)

[Cyberattacks Alleged Qilin Hacker Probed Over Synnovis Hospital Attack Oct 20, 2026](https://codekeeper.co/ticker/russian-arrested-qilin-cyber-gang-synnovis-hack)

[Cyberattacks Engineer Gets 32 Months for Ransoming His Own Employer Oct 12, 2026](https://codekeeper.co/ticker/kansas-city-man-jailed-for-bitcoin-ransom-scheme)