Hari 
Security researchers have identified GhostFrame, a previously undocumented post-exploitation framework that turns compromised VMware ESXi hypervisors into centralized command-and-control platforms.
Insikt Group linked the tooling to TAG-218, a threat activity group whose operations overlap with Settra ransomware, and warned that the framework could enable attackers to reach multiple virtual machines from a single foothold.
GhostFrame is designed for operators who already possess root-level access to an ESXi host. Rather than exploiting a vulnerability to obtain that access, the implant is deployed after compromise, then provides a unified interface for maintaining persistence, executing commands, managing virtual machines, harvesting credentials, and pivoting into internal networks.
GhostFrame
Its virtualization-layer position is particularly consequential: one compromised hypervisor can expose the guest systems, data, and credentials hosted on it without requiring attackers to compromise each virtual machine individually.
Analysis of recovered frontend files revealed a web-based operator panel with “Sessions” and “Builder” sections. The builder generates an ESXi implant named vmhostd-core, while the sessions interface lets operators monitor connected systems and invoke post-exploitation features.
The implant copies itself to /opt/vmhostd-core, modifies /etc/rc.local.d/local.sh, and repeatedly disables the ESXi firewall and the execInstalledOnly control, which prevents unsigned binaries from executing. It also runs /sbin/auto-backup.sh to preserve those changes across reboots.
To evade casual detection, GhostFrame modifies its process name and command-line representation to resemble VMware’s legitimate vmware-hostd daemon.
GhostFrame’s communications behavior may offer defenders a distinctive detection opportunity. The analyzed sample attempts simultaneous TCP connections to the same destination across ports 53, 2222, 3389, 4444, 8443, and 9443, retaining the first successful connection for command-and-control traffic.
If none connects within 30 seconds, it retries after a randomized five-to-twelve-second delay. Once connected, the implant functions chiefly as an in-memory shellcode loader, receiving machine code from the C2 server and executing it without writing it to disk; if executable memory cannot be allocated, it can establish a conventional /bin/sh reverse shell.
The framework also extends an attacker’s reach into hosted systems. It can enumerate registered VMs, inspect names and power states, alter power states, create or delete snapshots, enable VNC access, and relay graphical sessions through its C2 infrastructure. Operators can additionally expose the ESXi HTML Host Client through an operator-controlled tunnel.
A SOCKS5 proxy component, gfsox, enables traffic to be routed through the hypervisor toward otherwise inaccessible internal systems.
Credential access is a central capability. A component called sdkmon is described as a credential interceptor that can alter ESXi service configuration and capture usernames and passwords from subsequent logins.
GhostFrame also integrates VMkatz, an open-source credential-harvesting tool that can extract NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets, and NTDS.dit credential data from VM memory snapshots, virtual disks, or combined memory-and-disk analysis.
Mitigation
Insikt Group tied GhostFrame to TAG-218 infrastructure after observing victim-facing servers targeting VPN appliances in the United States and Europe between late August and October 2026, primarily SonicWall, Palo Alto Networks, and Fortinet devices. Four targeted organizations later appeared on the Settra ransomware leak site.
A victim Fortinet VPN appliance was observed beaconing to both GhostFrame and MeshCentral on October 12, placing the implant within the TAG-218 intrusion chain. Huntress previously linked MeshCentral to Settra intrusions, where attackers used RMM tools for persistence, cleared event logs, disabled recovery options, and deployed ransomware.
The activity also aligns with Palo Alto Networks’ reporting on CVE-2026-0257, an authentication bypass in GlobalProtect that can allow attackers to establish VPN sessions without valid credentials or MFA.
Unit 42 said attackers have moved from compromised VPN gateways to vCenter and ESXi systems, disabled execInstalledOnly, and used custom tooling to perform offline credential dumping from a domain controller’s virtual disk behavior consistent with GhostFrame’s capabilities.
Defenders should restrict and monitor privileged ESXi access, investigate changes to /etc/rc.local.d/local.sh, the presence of /opt/vmhostd-core or a vmhostd process, and repeated attempts to disable the firewall or execInstalledOnly.
They should also alert on the implant’s near-simultaneous multi-port connection pattern. Organizations should patch affected PAN-OS systems, apply the recommended GlobalProtect mitigations, and treat hypervisors as tier-zero assets rather than background infrastructure.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
Kiran 
3 thoughts on “GhostFrame ESXi Implant Linked to Settra Ransomware: New VMware Hypervisor Threat”