Ransomware · 3 days ago
Huntress found two Settra ransomware incidents, one in July and one in September, that used the legitimate MeshAgent remote management agent inside consumer retail and manufacturing environments. In the September case, Huntress says its own agent was installed mid-incident, showing the endpoint was already compromised before monitoring caught up.
Instead of dropping a clearly malicious tool, the operators used MeshAgent like ordinary admin software, then cleared logs and showed signs of bring your own vulnerable driver (BYOVD) activity to make the trail harder to follow. That means the post-compromise work can blend into the same remote-support traffic defenders already expect to see, while the evidence trail shrinks.
For teams that rely on RMM or other always-on admin tools, the exposure is not just the ransomware payload but the trust those tools already have. Where remote support is normal, malicious use of it can look like routine work until forensic visibility is already gone.
3 sources covering this story
New Settra Ransomware Variant Deployed in Attacks on Retail and Manufa
Huntress researchers highlighted a new ransomware variant, named Settra, and the post-compromise techniques used in two recent attacks
Settra ransomware variant deployed in recent attacks
Security researchers warned that hackers are using VPN credentials for initial access and deploying RMM tools.
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM | Huntress
Huntress has recently seen two incidents involving Settra, a ransomware variant that was first publicly reported in June 2026.
Part of the PlainSec briefing for 2026-09-21