On November 10, 2026, Recorded Future’s Insikt Group detailed GhostFrame, a new control panel and implant for VMware ESXi hypervisors. TAG-218, a group whose activity overlaps with Settra ransomware, uses it. GhostFrame exploits no bug, so operators need root on the host first. One panel can then switch off, snapshot, or remotely view the host’s VMs.
Its credential theft stands out. A module called sdkmon is built to capture later ESXi logins, and the bundled open-source VMkatz can pull NTLM hashes, Kerberos tickets, and NTDS.dit data from VM memory snapshots and disks, with no malware inside Windows guests. The implant also kills the ESXi firewall and execInstalledOnly about every five seconds, undoing admin fixes.
From late August to October 2026, TAG-218 servers targeted mostly SonicWall, Palo Alto Networks, and Fortinet VPN devices in the US and Europe, and four of the targeted organizations later appeared on Settra’s leak site. Insikt says other financially motivated groups will highly likely pick up GhostFrame or similar tools, and advises locking down ESXi management access, checking /etc/rc.local.d/local.sh, and flagging hosts that fire six near-simultaneous connections at one address.
Source: Cybersecurity News
