A newly documented toolkit called GhostFrame turns a single hacked VMware ESXi server into a control panel for every virtual machine running on it, letting operators open sessions on guest systems, snapshot them and pull Windows credentials out of their memory and disks. Recorded Future's Insikt Group found it in use by TAG-218, a threat activity group whose operations overlap with Settra ransomware.
That matters because a hypervisor is a force multiplier. Instead of breaking into each server one at a time, an attacker with root on ESXi can reach all of the machines it hosts from one place.
From a VPN appliance to the hypervisor
Insikt Group observed TAG-218 servers targeting VPN appliances in the US and Europe between late August and October 2026, mostly SonicWall, Palo Alto Networks and Fortinet devices. Four of the targeted organizations later appeared on Settra's leak site. The same infrastructure connected to two GhostFrame command-and-control (C2) servers and to a MeshCentral remote management server that Huntress had previously tied to Settra intrusions. On October 12, a victim's Fortinet VPN appliance was seen beaconing to both GhostFrame and MeshCentral in the same period.
Recorded Future notes the activity aligns with Palo Alto Networks' updated guidance on the GlobalProtect authentication bypass, which described attackers moving from a compromised VPN to the virtualization layer with a custom tool that disables ESXi security controls and harvests credentials.
An implant that keeps switching defenses off
GhostFrame does not break in by itself. Operators need root on the ESXi host first, then deploy an implant named vmhostd-core that its builder generates. The implant copies itself to /opt/vmhostd-core, edits the boot script /etc/rc.local.d/local.sh, and roughly every five seconds turns off the ESXi firewall and the execInstalledOnly setting that blocks unsigned binaries, so an administrator who re-enables them is quickly overridden. It disguises itself as a process called vmhostd, close to VMware's legitimate hostd daemon.
For C2, the implant tries six TCP ports at once (53, 2222, 3389, 4444, 8443 and 9443) and keeps whichever connects first. It then acts mainly as an in-memory shellcode loader, falling back to a plain reverse shell if it cannot. From the operator panel, GhostFrame can list and power-cycle VMs, create or delete snapshots, relay VNC sessions to guests, tunnel to the ESXi web client, and pivot through a SOCKS5 proxy called gfsox. A component called sdkmon is described in the panel as a credential interceptor for ESXi logins, and the open-source VMkatz tool is built in to extract NTLM hashes, Kerberos tickets, SAM and LSA secrets and NTDS.dit data from VM snapshots and disk images.
Insikt Group says the evidence does not show GhostFrame is exclusive to Settra, and assesses it is highly likely other financially motivated actors will adopt it or similar ESXi tooling.
Hunt for the boot script change, not just the toggles
Recorded Future advises restricting and monitoring root access to ESXi hosts, and checking for edits to /etc/rc.local.d/local.sh, the file /opt/vmhostd-core, a vmhostd process, and attempts to disable the firewall or set execInstalledOnly to 0. Because the implant keeps reverting those settings, fix the persistence first rather than simply switching them back on. Six near-simultaneous SYN packets from an ESXi host to one IP across the ports above are a useful network signal even if the C2 addresses change.
Indicators (defanged):
- 45[.]158[.]196[.]81 and 45[.]158[.]196[.]141 (TAG-218 GhostFrame C2)
- 193[.]5[.]65[.]114 (TAG-218 MeshCentral C2)
- SHA-256 a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10 (GhostFrame)
Ransomware crews have long treated ESXi as the place to deliver the final blow. GhostFrame shows them living there for the whole intrusion, which means the hypervisor deserves the same monitoring as the domain controller.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.