Newshot Article title: New GhostFrame malware can hijack VMware ESXi virtual machines and steal Windows credentials without running programs inside the VMs
Body:
A new attack toolkit named GhostFrame provides attackers with a unified control panel that can take over VMware ESXi servers and the virtual machines running on them.
Researchers from Insikt Group, part of Recorded Future, discovered the framework while tracking a threat group named TAG-218, whose activity is linked to Settra ransomware. The tool can extract Windows credentials stored by virtual machines without running any program inside the hosted VMs.
The core characteristic of GhostFrame lies in where it runs. ESXi is a hypervisor, the core layer that runs multiple virtual machines on a single physical server. Once attackers control this layer, they can access all systems running on it.
Security tools inside each virtual machine are typically unable to perceive operations occurring at the underlying layer. The Insikt Group report notes that the framework does not compromise the ESXi host by exploiting vulnerabilities; attackers must first obtain root privileges on the ESXi host to deploy it.
GhostFrame resides on ESXi servers, runs filelessly and can steal multiple types of credentials
The framework comes with a web control panel divided into two modules, "Sessions" and "Builder." The Builder module can generate an ESXi implant named vmhostd-core. Once running, the implant copies itself to the /opt/vmhostd-core path and modifies the startup script /etc/rc.local.d/local.sh to run automatically after every reboot.
The script also disables the ESXi firewall and the execInstalledOnly setting—the latter by default blocks unsigned programs from running. These operations are performed roughly every 5 seconds, so even if an administrator re-enables the protections, they are almost immediately disabled again.
The implant calls the /sbin/auto-backup.sh script to save the changes, ensuring the configuration persists after a reboot. It also renames itself to vmhostd, disguising itself as VMware's official vmware-hostd service and blending in among legitimate processes to evade detection.
The implant simultaneously attempts to connect to the command-and-control server over 6 network ports: 53, 2222, 3389, 4444, 8443, and 9443. It keeps the first successfully established connection and discards the rest. If all connections fail within 30 seconds, it waits 5 to 12 seconds before retrying. This behavior pattern manifests as a single ESXi host making 6 nearly simultaneous connection requests to the same address, which can provide defenders with an effective hunting lead.
After a successful connection, the implant loads code directly into memory and runs it, without writing any files to disk. If it cannot allocate enough memory to do so, it falls back to a basic /bin/sh reverse shell.
GhostFrame allows operators to list all virtual machines and adjust VM power states, create or delete snapshots. It can enable VNC remote screen access and forward the screen through its own server to the control panel. It can also expose the ESXi HTML Host Client, the hypervisor's management web page. A SOCKS5 proxy tool named gfsox allows operators to forward traffic through the ESXi host to reach internal systems that are not directly reachable from the internet.
Credential theft is the tool's most central harm. A component named sdkmon modifies the ESXi service configuration to capture the usernames and passwords of subsequent ESXi logins.
GhostFrame also includes the open-source tool VMkatz, which can extract sensitive information from VM memory snapshots, virtual disk images, or the results of scanning all virtual machines on a datastore. The data it can recover includes NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets, and NTDS.dit data. In short, attackers can steal Windows credentials from outside without installing any malware inside the virtual machines.
Linked to Settra ransomware, initial access exploits VPN device vulnerabilities
Insikt Group observed that between late August and October 2026, TAG-218's servers launched attacks against VPN devices in the United States and Europe, targeting mainly SonicWall, Palo Alto Networks, and Fortinet products.
Four of the victims subsequently appeared on Settra ransomware's leak site. The same batch of attack servers also connected to two GhostFrame command-and-control servers and one MeshCentral server used to maintain access. On October 12, 2026, researchers observed a Fortinet VPN device establishing communications with both GhostFrame and MeshCentral at the same time.
Huntress had previously linked MeshCentral to Settra ransomware. Its report shows that the group installs MeshAgent to achieve persistent access, uses vulnerable drivers, clears Windows logs, and blocks system recovery processes. Our previous reporting on Settra ransomware and its MeshAgent attack techniques covers these steps in more detail.
This attack timeline coincides with recent exploitation activity involving CVE-2026-0257. The vulnerability exists in Palo Alto Networks' GlobalProtect product and allows attackers to establish VPN sessions without valid credentials or MFA. Unit 42's updated guidance mentions that in one attack case, intruders moved laterally from the VPN perimeter to the virtualization layer.
Attackers disabled the execInstalledOnly setting and used custom tools to export credential data from domain controllers directly from virtual disks, bypassing security software inside the virtual machines. We previously reported on attackers using the Palo Alto Networks VPN vulnerability to steal credentials from VMware disks, and the GhostFrame attack technique discovered this time matches that pattern exactly. Palo Alto Networks released a patch for the vulnerability as early as May 2026.
Recommendations: strengthen ESXi access controls and monitor anomalous indicators to prevent attacks
Defenders should first strictly limit the scope of ESXi access, allowing only trusted systems to reach management ports, and investigate all anomalous root logins or configuration changes. Priority monitoring should cover modifications to the /etc/rc.local.d/local.sh file, new files under the /opt path, and repeated tampering with the firewall and execInstalledOnly settings.
Network logs should also be analyzed to look for the pattern of a single host making 6 concurrent connection attempts to the same address. VPN devices should be patched promptly; more hardening guidance can be found in our previous reporting on ransomware attacks against VMware ESXi.
Insikt Group has not yet confirmed whether GhostFrame is exclusive to the Settra group, nor is the tool's distribution scope clear. But the researchers judge that other financially motivated attackers are highly likely to use GhostFrame or similar ESXi attack tools. Enterprises should classify hypervisors as high-value protection targets and monitor them with the same priority as domain controllers.
New GhostFrame Malware Lets Hackers Hijack VMware ESXi VMs and Steal Windows Credentials