Anyone who runs VMware ESXi servers has a new thing to check for. Recorded Future has published a teardown of GhostFrame, an attack toolkit that turns one compromised ESXi host into a control point for every virtual machine on it, including a way to lift Windows passwords from those machines without touching software inside them.
GhostFrame is not an exploit. The attacker must already hold root on the host, so it matters after a break-in through something else, such as a VPN appliance. Recorded Future’s Insikt Group says it turned up while tracking a group it calls TAG-218, whose activity overlaps with the Settra ransomware operation.
The report lists signs defenders can look for. A file named vmhostd-core sits in the /opt folder, and a process called vmhostd imitates VMware’s genuine vmware-hostd service. The implant also rewrites the host’s startup script so that it launches at boot, and every few seconds that script shuts off the ESXi firewall and the setting that blocks unsigned programs. Turning them back on achieves little, since the script undoes it within seconds.
On the network, the implant tries six ports simultaneously (53, 2222, 3389, 4444, 8443 and 9443) and keeps whichever connection succeeds first. Six near-identical connection attempts from one host to one address is therefore a tripwire. Whatever the operators send is run from RAM only, which leaves forensic teams few files to examine.
The attacker’s panel has a Sessions view and a Builder that outputs the implant. From Sessions they can list the host’s VMs, power them on or off, take or delete snapshots and open a remote screen on one. A relay named gfsox, built on the SOCKS5 protocol, gives the intruder a tunnel into networks that outsiders normally cannot reach. Two pieces deal with credentials: sdkmon captures ESXi logins, and the open-source VMkatz reads Windows secrets from VM memory snapshots, disk images or an entire datastore. That includes NTLM hashes, Kerberos tickets and Active Directory data.
The tie to Settra comes from infrastructure. Between late August and October 2026, TAG-218 servers probed SonicWall, Palo Alto Networks and Fortinet VPN devices in the US and Europe, and four of the organisations affected were later named on the Settra leak site. On 12 October a victim’s Fortinet device was seen contacting a GhostFrame server and a MeshCentral management server that Huntress had linked to Settra before. Palo Alto Networks has described the same route for attackers who use its GlobalProtect login bypass, CVE-2026-0257: from the VPN gateway down to the virtualisation layer, where ESXi’s protections are disabled.
Insikt Group cannot say GhostFrame belongs only to Settra, and expects other financially motivated groups to adopt it or something like it. Its advice is to limit who can administer ESXi hosts, investigate edits to the startup script and unexplained root activity, and treat a firewall that keeps switching off as a persistence problem rather than something to re-enable.
