Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
Settra ransomware deploys MeshAgent RMM and BYOVD for persistence and defense evasion, encrypting files with .locked extensions while exfiltrating data for double extortion. Settra ransomware uses MeshAgent RMM for persistence and gdrv.sys BYOVD to impair defenses. The ransomware executable is named after the victim's domain with _win64.exe appended. Post-encryption, it clears event logs, disables WinRE, removes recovery partitions, and overwrites free space with cipher utility.
Detection / Hunteropenrouter
Immediate Actions
- Block IPs 45.13.122.7 and 193.5.65.114 at network perimeter
- Hunt for MeshAgent installations across all endpoints
- Isolate systems where gdrv.sys or renamed MeshAgent binaries are found
Key Takeaways
- Ransomware executable named after victim domain appended with _win64.exe
- MeshAgent RMM used for persistent access; renamed to mvtcs.exe in July incident
- BYOVD gdrv.sys deployed in September incident to impair security tooling
- Ransomware embeds commands to disable WinRE, clear event logs, overwrite free space
- Workstation name WIN-LIVFRVQFMKO linked to C2 193.5.65.114 in prior incidents dating to Dec 2024
Attack Chain
- Initial Access: Attackers use compromised VPNs and credentials (per public reporting)
- Persistence: MeshAgent RMM installed for persistent remote access
- Defense Evasion: BYOVD gdrv.sys deployed to impair security tooling
- Execution: Ransomware executable named after victim domain plus _win64.exe launched
- Impact: Files encrypted with .locked or .locked_wip extension
- Defense Evasion: Event logs cleared, WinRE disabled, recovery partition removed, free space overwritten
Affected Systems
- Windows systems targeted by Settra ransomware
- Systems with VPN access compromised via credentials
- Endpoints lacking kernel driver blocklisting
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | EDR telemetry detected MeshAgent, BYOVD, ransomware launch, and post-encryption commands. |
| Network Visibility | Medium | C2 IPs observed in network connections and certificate data for MeshAgent. |
| Detection Difficulty | Moderate | RMM use and native utilities mimic admin activity but unusual combinations stand out. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Processes named after the victim domain with _win64.exe executing from non-standard folders (T1486) | EDR process execution logs | Impact | Low — domain-named executables are rare |
| MeshAgent or other RMM software installed outside IT-managed deployment pipelines (T1219) | EDR software installation events | Persistence | Medium — legitimate RMM use in IT environments |
| gdrv.sys or other vulnerable kernel drivers loaded as services on endpoints without driver blocklisting (T1562.001) | Sysmon driver load events, service creation | Defense Evasion | Low — gdrv.sys rarely loaded on modern systems |
| Batch clearing of multiple Windows Event Logs followed by reagentc disable and diskpart execution (T1070.001, T1490) | Windows Event Log clear events, process telemetry | Defense Evasion | Low — combined log clearing and recovery disabling is anomalous |
Required Log Sources
- EDR process telemetry
- Windows Event Logs
- Network connection logs
- Sysmon Operational log
- DNS resolution logs
- Service creation events
Key Behavioral Indicators
- Executable named after victim domain with _win64.exe suffix
- MeshAgent RMM installed outside managed software deployment
- gdrv.sys kernel driver loaded as service gdrv_byovd
- cipher.exe invoked with /w switch to overwrite free space
- reagentc.exe with /disable argument launched by ransomware process
- Workstation name WIN-LIVFRVQFMKO associated with C2 activity
Control Gaps
- No kernel driver blocklist allows BYOVD loading
- Unmonitored RMM installations evade alerting
- Native utility abuse blends with admin activity
- Event log clearing removes forensic evidence
- Recovery environment not protected from tampering
False Positive Assessment
Medium — MeshAgent and native Windows utilities have legitimate admin uses, but domain-named executables and BYOVD loading are high-confidence indicators.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enable Microsoft Vulnerable Driver Blocklist to prevent BYOVD loading
- Block MeshAgent and unsanctioned RMM tools via application allowlisting
- Enforce MFA on all VPN access points
- Monitor for unauthorized service installations matching gdrv_byovd
User Protection
- Restrict execution from Perflogs and Documents folders
- Alert on cipher.exe invocations with /w parameter
- Monitor for reagentc.exe /disable launched by non-admin processes
Security Awareness
- Train staff to report unexpected remote management tool installations
MITRE ATT&CK Mapping
Initial Access
Stealth
Collection
Command and Control
Exfiltration
Plain-Language Summary
A new ransomware called Settra has been attacking organizations since June. The attackers install remote management software called MeshAgent to maintain access and sometimes use a vulnerable driver to disable antivirus. The ransomware encrypts files, adds a ransom note, and takes steps to prevent data recovery. Organizations should monitor for unauthorized remote management tools and block known malicious drivers.
Additional IOCs
- File Paths:
C:\Program Files\Mesh Agent\MeshAgent.exe- MeshAgent RMM installation pathC:\Users\[redacted]\gdrv.sys- BYOVD driver file path in September incident
- Command Lines:
- Purpose: Overwrite free space on volumes to hinder data recovery | Tools:
cmd.exe,cipher.exe| Stage: Impact |cmd.exe /c cipher /w:<drive>:\ - Purpose: Disable Windows Recovery Environment | Tools:
reagentc.exe| Stage: Impact |reagentc.exe /disable - Purpose: Flush DNS cache to remove network activity traces | Tools:
ipconfig.exe| Stage: Defense Evasion |ipconfig /flushdns - Purpose: Remove recovery partition via script | Tools:
diskpart.exe| Stage: Impact |diskpart.exe /s <script>
- Purpose: Overwrite free space on volumes to hinder data recovery | Tools:
- Other:
WIN-LIVFRVQFMKO- Malicious workstation name linked to C2 and prior incidents
- filenamegdrv.sysBYOVD driver used to impair security tools
- filenamemvtcs.exeRenamed MeshAgent RMM in July incident
- filenameRESTORE_FILES.txtRansom note created in both incidents
- file_pathC:\ProgramFiles\MeshAgent\MeshAgent.exeMeshAgent RMM installation path
- file_pathC:\Users\[redacted]\gdrv.sysBYOVD driver file path in September incident
- ip193[.]5[.]65[.]114MeshAgent C2 address in September incident
- ip45[.]13[.]122[.]7MeshAgent C2 address in July incident