GhostFrame ESXi Implant Tied to Settra Ransomware, Targets VMware Hypervisors

Recorded Future discloses GhostFrame, a post-exploitation framework for VMware ESXi, attributed to TAG-218 and linked to Settra ransomware. The implant enables persistent access and ransomware deployment on virtualized infrastructure, expanding the group's targeting of enterprise hypervisors. The full scope of affected organizations remains undisclosed, but the development signals an escalation in ransomware operations against critical virtualization layers.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works