SETTRA RANSOMWARE

What it is

A continuously-updated threat profile of Settra, a ransomware brand that surfaced June 2026 (US/Germany/UK/Canada; Tech, Manufacturing, Retail; avoids Healthcare). The summary covers the tradecraft; what it omits is the concrete IOC set and negotiation mechanics an engineer needs to build detections and hunt.

Indicators the summary does not carry

• DLS onion: settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion
• Negotiation panel: settra5ceeidlmbt2d7zupsb3r7djl2azjj4mho5kznmdap6vnoxoxqd.onion (nginx/1.22.14)
• Active file-server nodes: r2vpglmz42fs5762tchek55bg4kdg3c6ozipg7wqs2ghzbhsdtwkzmyd.onion, rz5lecsm2re5ec4im362jnalrypxylxsdobuibuotbovvs4d3ctrcoyd.onion, hhj2nouojnatg6gvhfgrcqdanoe244gf26pixpnrcoxs7jiqu4atvzyd.onion, plus newly-spotted wqdopgpr7cubbjcf2kiac6ilvamch3renqlzrly2dtwm3uyv2235zryd.onion
• Retired nodes (dropped late Aug 2026): pbxvml6h3wz35qlr5muy2cg5jvjsd4qhjlsztmxj4lqkyohnfdrntqyd.onion, 26z3gms2rshr2zzedxhw5fbucilmgt2inhmxzmuhteyztpxohoqplgyd.onion, ttfy4zmtiaywfkkmykpxiwtlxkcr5ofvrhqgxxyspgwzbxkc3uze7jid.onion, c3u3g7dz2yxkefci3x34jfvfa4gka4iogi4zfjkyxx2c536oqdld4kid.onion
• TOX contact: D288571294F08ADDFE46DF631194745143BE8B40F9F846379040DC40EB39BC2E8CE056B66927
• BTC wallet (final-deal): bc1qfvm4gllzxdf6dwxx3e5dml02zealvkwqemxkv0wf8h0wr6ejc2mseeyhpw
• Ransom note: RESTORE_FILES.txt
• File servers use non-vanity onions (unlike the "SETTRA5" vanity DLS/panel) — useful for infrastructure clustering.

Operational details worth acting on

• Initial vector: page estimates ~50% infostealer infection (credentials bought on dark web) — hunt stealer logs / anomalous credential reuse.
• Exfil: assessed as RClone; 3.2TB pulled in ~7–8h on 1Gbps, under 1h on 10Gbps — egress-volume alerting is a viable trip.
• Timers: ~18-day standard DLS countdown; 20-day negotiation window; 2–4 days from timer expiry to full leak publication.
• Negotiation ladder observed: $900k → $800k → $700k → $650k → $600k → $500k, with a new BTC wallet issued on final agreement.

Caveats

• Infostealer vector and RClone are the analyst's assessment, not confirmed — treated as factors, not proof.
• De-listings cannot be read as payment; the page notes they may be a pressure tactic and are unconfirmable without victim evidence.
• The panel's Return Key (auto-generated per session, distinct from the ransom-note Login ID) means a leaked Login ID alone won't surface the real negotiation chat — relevant if you attempt victim-side access.
• IOCs are also published to the author's linked GitHub.