Full Report
Settra is a newer ransomware variant that was first observed in June 2026. Based on public reporting, the attackers behind the variant have targeted virtual private networks (VPNs) or used compromised credentials for initial access. Huntress has investigated two Settra ransomware incidents since July. Although the initial access method could not be confirmed, both attacks used ransomware executables named after the victim organization's domain and followed a highly similar operational pattern. In the observed intrusions, attackers deployed remote monitoring and management (RMM) tools for persistence and then encrypted files, dropped RESTORE_FILES.txt ransom notes, cleared Windows event logs, and disabled Windows recovery options. One incident also included signs of Bring Your Own Vulnerable Driver (BYOVD); as well as a notable misspelling by the threat actors during the attack which left them unable to clear the Windows Defender Event Log.
Analysis Summary
# Tool/Technique: Settra Ransomware
## Overview
Settra is a ransomware variant first identified in June 2026. It is characterized by its targeted approach, often naming its malicious executables after the victim organization's domain. The threat actors behind Settra focus on maintaining persistence via legitimate remote management tools and employ defense evasion techniques such as clearing logs and utilizing "Bring Your Own Vulnerable Driver" (BYOVD) attacks to disable security products.
## Technical Details
- **Type:** Malware family (Ransomware)
- **Platform:** Windows
- **Capabilities:** File encryption, defense evasion, persistence via RMM, disabling recovery options.
- **First Seen:** June 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1133 - External Remote Services] (VPN targeting)
- [T1078 - Valid Accounts] (Compromised credentials)
- **[TA0003 - Persistence]**
- [T1219 - Remote Service Session Hijacking] (Use of RMM tools like MeshAgent)
- **[TA0005 - Defense Evasion]**
- [T1070.001 - Indicator Removal: Event Log Clearing]
- [T1068 - Exploitation for Privilege Escalation] (BYOVD)
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (Disabling Windows Defender/Recovery)
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
- [T1490 - Inhibit System Recovery]
## Functionality
### Core Capabilities
- **File Encryption:** Encrypts user data and appends a specific extension (often linked to the victim's domain).
- **Ransom Note Deployment:** Drops a text file named `RESTORE_FILES.txt` containing payment instructions.
- **System Recovery Inhibition:** Uses native Windows commands to disable recovery options and delete shadow copies to prevent restoration without the decryptor.
### Advanced Features
- **BYOVD (Bring Your Own Vulnerable Driver):** Leverages known vulnerable drivers to gain kernel-level access and terminate security software processes.
- **Customized Payload:** The executable is frequently compiled or renamed to match the target's internal domain name to blend into the environment.
- **Automated Anti-Forensics:** Attempts to clear Windows Event Logs, though recent reports indicate potential for human error/misspellings in their scripts (e.g., failing to clear Defender logs due to typos).
## Indicators of Compromise
- **File Names:** `[VictimDomain].exe`, `RESTORE_FILES.txt`
- **Behavioral Indicators:**
- Execution of `wevtutil.exe cl` (Log clearing)
- Execution of `vssadmin.exe delete shadows /all /quiet`
- Unrecognized installations of RMM tools (e.g., MeshAgent, SimpleHelp)
- Loading of unsigned or known vulnerable third-party drivers.
## Associated Threat Actors
- Specific group names are not yet publicly attributed, but the actors are known to target **Consumer Services, Retail, and Manufacturing** sectors.
## Detection Methods
- **Signature-based detection:** Monitor for the specific `RESTORE_FILES.txt` string and ransomware headers.
- **Behavioral detection:**
- Identify mass file renaming/encryption activities.
- Alert on the unauthorized use of RMM tools in environments where they are not standard.
- Monitor for the deletion of Volume Shadow Copies and clearing of Security/System Event Logs.
- **YARA Rules:** Target the unique strings in the `RESTORE_FILES.txt` note and the BYOVD driver loading patterns.
## Mitigation Strategies
- **VPN Hardening:** Implement Multi-Factor Authentication (MFA) on all VPN and external-facing remote services.
- **Credential Hygiene:** Enforce strong password policies and monitor for leaked credentials.
- **Driver Signature Enforcement:** Enable Windows "Driver Signature Enforcement" and use policies to block known vulnerable drivers (Microsoft Vulnerable Driver Blocklist).
- **RMM Restrictions:** Maintain an inventory of authorized RMM tools and block execution of unauthorized RMM binaries (e.g., MeshAgent) via AppLocker or EDR policies.
## Related Tools/Techniques
- **MeshAgent / SimpleHelp:** Legitimate RMM tools frequently abused for persistence.
- **BYOVD:** A technique also commonly used by groups like BlackByte and Scattered Spider.
- **LockBit / ALPHV:** Similar operational patterns regarding the disabling of recovery options and log clearing.