Summary
- Recorded Future identified GhostFrame, a post-exploitation framework designed for compromised VMware ESXi systems.
- The toolkit provides persistence, virtual machine management, credential harvesting, and access to internal networks.
- Researchers link its activity to TAG-218 infrastructure overlapping with Settra ransomware operations, without establishing exclusive attribution.
Attackers with privileged access to VMware ESXi infrastructure can use a newly identified malware framework to control virtual machines, collect credentials, and move through enterprise networks, according to research linking the toolkit to ransomware-related activity.
Cyber threat intelligence company Recorded Future has identified GhostFrame, a previously undocumented framework designed to operate directly on compromised virtualisation hosts.
Its Insikt Group research team connected the malware to infrastructure operated by a threat cluster tracked as TAG-218, whose activity overlaps with Settra ransomware operations.
GhostFrame is a post-exploitation framework: attackers must already have root-level access to an ESXi host before deploying it. The software does not independently provide the initial vulnerability or entry route needed to gain control of the hypervisor.
Once installed, however, it offers capabilities affecting multiple virtual machines hosted on the same physical system.
Hypervisor control spans multiple workloads
VMware ESXi allows organisations to run separate virtual machines on shared physical servers, supporting applications, databases, identity systems, and other essential infrastructure.
Administrative access at the hypervisor layer can therefore expose a broader set of workloads than compromise of an individual guest operating system.
Recorded Future found that GhostFrame provides a management interface to enumerate virtual machines, inspect their power states, manipulate snapshots, and obtain remote access to hosted systems.
The framework also supports network pivoting through the compromised host, potentially allowing an attacker to reach internal services not directly accessible from the internet.
These features are particularly relevant to ransomware-related intrusions, where attackers may seek to reach multiple operational systems after obtaining privileged access to a central infrastructure component.
Persistence weakens host-level controls
Analysis of a recovered GhostFrame implant found mechanisms intended to preserve access across ESXi host restarts.
The implant modifies startup configuration and repeatedly attempts to disable the host firewall and a security feature restricting the execution of unauthorised binaries.
Its persistence can reverse attempts to restore those settings while the malicious component remains active.
The code also changes its apparent process name to resemble a legitimate VMware management service, potentially reducing the visibility of suspicious activity during routine inspection.
Monitoring confined to virtual machines may not identify malicious changes made on the underlying hypervisor, particularly where security tools cannot inspect host-level processes and configuration.
Credential access creates further exposure
GhostFrame incorporates components capable of examining virtual machine memory and disk data to obtain credential material from hosted Windows systems.
The framework also includes functionality associated with intercepting credentials used for access to ESXi management services.
Where credentials are obtained, their potential value depends on the privileges assigned to accounts and whether they can be reused against directory services, administrative platforms, or other systems.
The presence of credential-harvesting functionality does not establish that every observed deployment successfully obtained credentials, or that attackers reached every virtual machine on a host.
Infrastructure links indicate ransomware overlap
Insikt Group observed TAG-218 infrastructure targeting VPN appliances associated with organisations in Europe and the United States between late August and October 2026.
The targeted products included devices from SonicWall, Palo Alto Networks, and Fortinet. Four organisations associated with the observed infrastructure later appeared on the Settra ransomware leak site.
Researchers also found connections between GhostFrame command-and-control systems and remote management tooling previously associated with Settra intrusions.
On 12 October, a victim Fortinet VPN appliance reportedly communicated with infrastructure connected to both GhostFrame and the related management tool.
The overlap supports an association between the framework and the TAG-218 activity cluster. It does not prove GhostFrame is exclusive to Settra operators or establish how every victim was initially compromised.
ESXi hosts require dedicated monitoring
Restricting administrative access to hypervisors remains an important barrier because GhostFrame requires existing root-level privileges for deployment.
Organisations also need to investigate unexplained changes to host security settings, suspicious startup entries, and unusual connections originating from virtualisation infrastructure.
If a persistence mechanism continues disabling protective controls, restoring individual settings without addressing the underlying intrusion may not provide a lasting remedy.
Recorded Future’s technical report describes the recovered components and defensive indicators.
The case demonstrates how a single compromised hypervisor can give an attacker a central position from which to manage, observe, and potentially move between workloads that otherwise appear separate within an enterprise environment.
