A new ransomware variant named Settra has been deployed in incidents targeting the retail and manufacturing sectors, according to Huntress.
The variant was first observed in June, and Huntress researchers highlighted notable post-compromise techniques used by threat actors deploying Settra in attacks against an organization in the consumer services and retail sector in July, and a manufacturing firm in September.
These techniques include deploying remote monitoring and management (RMM) tools for persistent access, efforts to disable the victims’ recovery options, and installing bring your own vulnerable driver (BYOVD) to impacted systems.
The Huntress blog, published on September 17, highlighted how previous research on Settra showed the variant was used for double-extortion tactics, with the attackers threatening to release sensitive corporate information alongside encrypting systems.
There is currently not enough evidence to state that Settra is a ransomware-as-a-service (RaaS) operation, the researchers noted.
Key Post-Compromise Activities
Huntress said it was unable to confirm how the attackers gained initial access for the two incidents.
In the July attack on a retail organization, the threat actor installed the MeshAgent RMM in the victims’ environment, which connected to an IP address linked to the command-and-control (C2) infrastructure.
The next day, the ransomware executable was launched from the C:\Perflogs folder. This led to victim files being encrypted and renamed with the .locked file extension, before a ransom note was created.
EDR telemetry showed that immediately after the ransomware executable was launched, the threat actor took steps to prevent the victim organization’s recovery. This included clearing several Windows Event Logs, disable the Windows Recovery Environment, used ipconfig /flushdns to flush the DNS cache, and ran the diskpart native Window utility via a script to remove a recovery partition.
In addition, threat actors used the command cmd.exe /c cipher /w:D:\ >nul 2>&1 to launch the native Windows cipher utility to overwrite free space on multiple file volumes. This was done to make it more difficult to recover deleted data.
In the September attack on a manufacturing organization, similar techniques were used by threat actors, including the installation of the MeshAgent RMM and the disabling of recovery options once the ransomware executable was launched. However, there was one notable addition – the use of BYOVD. These drivers are installed for a range of purposes, including impacting onboard security tooling and crashing services related to antivirus applications.
The researchers noted that the attackers misspelled one of the Windows Event Logs they were attempting to clear, stopping this action from being carried out.
The workstation name WIN-LIVFRVQFMKO was associated with the malicious activity carried out during the September incident. This name was previously observed as associated with other incidents going back to December 2024 by Huntress.
In both incidents, the ransomware executable was named for the impacted organization’s domain name, appended with _win64.exe.
“While there were slight differences between the two incidents, such as the naming and C2 IP address of the MeshAgent RMM, as well as the folders the threat actors operated from, the overall conduct of the attacks were remarkably similar,” the researchers wrote.
Recommendations for Defenders
The researchers noted that new ransomware variants are frequently emerging, and each come with their own distinct tactics, techniques and procedures (TTPs).
Read now: A New Ransomware Threat Actor Emerges Every Week, Warns Report
They urged security teams to stay up-to-date with these variants, and the post-compromise techniques used to help detect and respond to such attacks.
Defenders should also continue to focus on the “fundamentals” of cyber defense to prevent these attacks occurring, the blog added.
