Skip to content

Back to the catalog

Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
huntress.comwriteup

Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM

Huntress analysts detail two Settra ransomware incidents (July and September) observed in customer environments, documenting the threat actor's use of the MeshAgent RMM for persistence, BYOVD via the gdrv.sys driver, and anti-forensic techniques including Windows Event Log clearing, reagentc /disable, diskpart-based recovery partition removal, and cipher.exe free-space wiping. The post includes specific IOCs — C2 IPs 45.13.122[.]7 and 193.5.65[.]114, the recurring workstation name WIN-LIVFRVQFMKO, and the RESTORE_FILES.txt ransom note — supplementing prior public reporting from MoxFive and SOCRadar on this newer ransomware variant first seen in June.

TL;DR Huntress DFIR writeup on Settra ransomware: MeshAgent RMM abuse, BYOVD (gdrv.sys), event log clearing, and IOCs from two real incidents.
Open original ↗
Document

What it is

Two Huntress-observed Settra ransomware incidents (July and September 2025) with post-compromise TTPs. Beyond the IOCs the summary lists, the page carries specific detection artifacts: a naming convention, the exact set of Event Logs cleared, and a spelling bug in the ransomware's own log-clearing routine that leaves one log intact.

Detection specifics the summary omits

Executable naming. In both incidents the ransomware binary was named for the victim's domain, appended with _win64.exe. Encrypted files took .locked (July) or .locked_wip (September). The recovery-inhibition commands are embedded in the executable and run as child processes of that image — so reagentc /disable, diskpart.exe <script>, and the log clears all parent to the _win64.exe process.

The Defender log survives. The September binary attempts to clear these logs:

Application, Security, System, Setup, ForwardedEvents,
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Microsoft-Windows-TerminalServices-RDPClient/Operational
Microsoft-Windows-Sysmon/Operational
Microsoft-Windows-PowerShell/Operational
Microsoft-Windows-WinRM/Operational
Microsoft-Windows-TaskScheduler/Operational
Microsoft-Windows-Defender/Operational

The last entry is misspelled — the real channel is Microsoft-Windows-Windows-Defender/Operational — so Defender's operational log is NOT cleared. That log is your intact forensic source after a Settra hit; do not assume it was wiped with the rest.

Free-space wipe (July only). The cipher step, absent in September:

cmd.exe /c cipher /w:D:\ >nul 2>&1

RMM artifacts. July: MeshAgent renamed mvtcs.exe, launched from C:\Perflogs, C2 45.13.122[.]7. September: MeshAgent not renamed, C2 193.5.65[.]114 (also embedded in the executable's certificate info and seen in live network connections). September BYOVD used gdrv.sys; July showed no BYOVD.

Reused infrastructure. Workstation name WIN-LIVFRVQFMKO ties to activity going back to Dec 24, 2024, and is paired with 193.5.65[.]114 across incidents from Nov 2025 through Feb 2026 — treat this pair as a durable hunting pivot, not a one-off IOC.

Caveats

Huntress did not confirm the initial access vector for either incident (public MoxFive reporting cites VPN compromise and stolen credentials). The diskpart script was unrecoverable in both cases; recovery-partition removal is an assessment. No evidence the victims actually used a Recovery Environment or recovery partition — the destructive commands ran unconditionally.

Organisations named here

  • 193.5.65.114
  • 45.13.122.7
  • gdrv.sys
  • RESTORE_FILES.txt
  • WIN-LIVFRVQFMKO

Technologies named here

  • Windows
  • MeshAgent RMM
  • gdrv.sys driver
  • cipher
  • diskpart
  • reagentc
  • ipconfig
  • Huntress EDR/Huntress agent
  • MeshAgent
  • EDR
  • Huntress

Techniques named here

  • BYOVD
  • Windows Event Log clearing
  • Disabling Windows Recovery Environment
  • Recovery partition removal
  • Free space wiping / anti-forensics
  • DNS cache flushing
  • File encryption / ransomware deployment
  • RMM abuse for persistence
  • Compromised credentials / VPN compromise

Threat actors named here

  • Settra ransomware

Related in Threat Intel