A new hacking toolkit called GhostFrame gives criminals a single control panel for taking over VMware ESXi servers and the virtual machines that run on them.
Researchers at Recorded Future’s Insikt Group found the framework while tracking a group named TAG-218, whose activity overlaps with Settra ransomware. The tool can also pull Windows passwords out of hosted machines without ever running a program inside them.
The key point is where GhostFrame works. ESXi is a hypervisor, the layer that runs many virtual machines on one physical server. If a criminal controls that layer, they can reach every system on it.
Security tools inside each virtual machine often cannot see what is happening below them. Insikt Group’s report says the framework does not exploit a bug to get in. The operator must already have root access to the ESXi host.
GhostFrame Stays on the Server
The framework has a web panel with two sections, “Sessions” and “Builder.” The builder creates an ESXi implant named vmhostd-core. Once it runs, it copies itself to /opt/vmhostd-core and edits the boot script /etc/rc.local.d/local.sh so it starts again after every reboot.
The script also turns off the ESXi firewall and the execInstalledOnly setting, which normally blocks unsigned programs. It repeats this about every five seconds, so an administrator who turns the protections back on loses them again almost at once.
The implant calls /sbin/auto-backup.sh to save its changes across restarts. It also renames itself vmhostd, which looks like VMware’s real vmware-hostd service, to hide in plain sight.
The implant tries six network ports at the same time to reach its command server: 53, 2222, 3389, 4444, 8443 and 9443. It keeps the first connection that works and drops the rest. If nothing connects within thirty seconds, it waits between five and twelve seconds and tries again. That pattern can show up as six nearly simultaneous connection requests from one ESXi host to one address, which gives defenders a useful clue to hunt for.
After connecting, the implant loads code straight into memory and runs it, so nothing is written to disk. If it cannot get memory for that, it falls back to a plain /bin/sh reverse shell.
GhostFrame lets an operator list virtual machines, change their power state, and create or delete snapshots. It can switch on VNC remote screen access and send the screen view through its own servers to the panel. It can also expose the ESXi HTML Host Client, which is the management website for the hypervisor. A SOCKS5 proxy tool named gfsox lets operators send traffic through the host to reach internal systems that are hidden from the internet.
The credential theft features matter most. A component called sdkmon changes the ESXi service setup and captures the usernames and passwords of later ESXi logins.
GhostFrame also includes VMkatz, an open-source tool. It pulls secrets from VM memory snapshots, virtual disk images, or a scan of every VM on a datastore. The data it can recover includes NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets, and NTDS.dit data. In short, a criminal can steal Windows passwords from the outside, with no malware installed in the guest.
Link to Settra Ransomware and VPN Break-Ins
Insikt Group watched TAG-218 servers go after VPN devices in the US and Europe from late August to October 2026. The targets were mostly SonicWall, Palo Alto Networks, and Fortinet products.
Four of those victims later appeared on the Settra leak site. The same servers connected to two GhostFrame command servers and a MeshCentral server used to maintain access. On October 12, 2026, a Fortinet VPN device was seen contacting both GhostFrame and MeshCentral.
Huntress had already tied MeshCentral to Settra. Its report shows the group installing MeshAgent for lasting access, using a vulnerable driver, clearing Windows logs, and blocking recovery. Our earlier coverage of the Settra ransomware and its MeshAgent tricks covers those steps in more detail.
The timing matches the recent abuse of CVE-2026-0257, a flaw in Palo Alto Networks GlobalProtect that lets someone open a VPN session without valid credentials or MFA. Unit 42’s updated guidance says intruders moved from the VPN to the virtualization layer in one case.
They turned off execInstalledOnly and used a custom tool to dump domain controller credentials straight from a virtual disk. That skips security software inside the guest. We reported on how hackers used this Palo Alto VPN flaw to steal credentials from VMware disks, and the GhostFrame findings fit the same pattern. Fixes for the Palo Alto flaw have been out since May 2026.
Start by locking down who can reach ESXi. Allow management access only from trusted systems and look into any unexpected root logins or setting changes. Watch for edits to /etc/rc.local.d/local.sh, new files under /opt, and the repeated firewall and execInstalledOnly changes.
Look at network logs for the burst of six connection attempts to one address. Patch VPN devices quickly and review the earlier reporting on ransomware groups targeting VMware ESXi for more hardening ideas.
Insikt Group does not know if GhostFrame is limited to Settra or how it is shared. Still, it says it is highly likely that other money-driven criminals will use GhostFrame or similar ESXi tools. Treat your hypervisors as high-value systems and give them the same close watch you give domain controllers.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
Click Here For The Original Source.
——————————————————–
