Security researchers have uncovered a new attack toolkit, dubbed GhostFrame, that gives criminals centralized remote control over VMware ESXi hosts and every virtual machine sitting on top of them. Unlike malware that infects an operating system directly, GhostFrame operates one layer down, at the hypervisor itself, which means it can reach into guest systems without ever planting a file inside them.

A Control Panel Built for Hypervisor Takeovers

The discovery comes from Recorded Future’s Insikt Group, which spotted the framework while investigating a threat actor it tracks as TAG-218. The group’s activity overlaps with the Settra ransomware operation, suggesting GhostFrame is being used as an access and reconnaissance tool ahead of encryption and extortion.

GhostFrame is managed through a web dashboard with two main functions: a “Builder” that generates a custom ESXi implant, and a “Sessions” view for managing compromised hosts. Once deployed, the implant — internally named vmhostd-core — copies itself onto the host and rewrites a startup script so it survives reboots. It also repeatedly disables the ESXi firewall and a setting called execInstalledOnly, which is designed to block unsigned code from running. Because the implant re-applies these changes roughly every five seconds, an administrator who manually restores the protections will see them stripped away again almost immediately.

To blend in, the malware renames its running process to resemble VMware’s legitimate vmware-hostd service — a small detail that makes it easy to miss during a routine process review.

Credential Theft Without Touching the Guest OS

What sets GhostFrame apart from ordinary hypervisor backdoors is its focus on harvesting Windows credentials from the outside. One component, referred to as sdkmon, quietly modifies ESXi’s service configuration to capture usernames and passwords as administrators log in. A second component bundles the open-source tool VMkatz, which can extract secrets directly from virtual machine memory snapshots, virtual disk files, or a full scan of every VM on a given datastore.

The haul from that process can include NTLM hashes, WDigest credentials, Kerberos tickets, and data from the Windows SAM, LSA, and NTDS.dit stores — effectively the same material an attacker would normally need to compromise a domain controller directly, obtained instead by reaching under the operating system entirely.

The implant also supports more conventional remote-access features: listing and powering virtual machines on or off, creating or deleting snapshots, enabling VNC screen access relayed through GhostFrame’s own infrastructure, and exposing the ESXi management web interface. A bundled SOCKS5 proxy tool, gfsox, lets an operator route traffic through the compromised host to reach internal network segments that would otherwise be unreachable from the internet.

When communicating with its command infrastructure, the implant tries six network ports simultaneously — 53, 2222, 3389, 4444, 8443, and 9443 — and keeps whichever connection succeeds first. Seeing a single ESXi host fire off six near-simultaneous connection attempts to the same external address is an unusual enough pattern that it can serve as a useful detection signal for defenders monitoring outbound traffic.

Tied to VPN Break-Ins and the Settra Ransomware Group

Insikt Group’s telemetry shows TAG-218 infrastructure probing VPN appliances — primarily from SonicWall, Palo Alto Networks, and Fortinet — across the US and Europe between late August and October 2026. At least four organizations that were targeted this way later turned up on Settra’s ransomware leak site, and the same attacker infrastructure was also linked to a MeshCentral server used for persistent remote access, a tool previously tied to Settra by incident responders at Huntress.

The timing overlaps with active exploitation of CVE-2026-0257, a Palo Alto Networks GlobalProtect flaw that allows VPN access without valid credentials or multi-factor authentication. Researchers at Unit 42 have documented at least one case where intruders pivoted from a compromised VPN straight into the virtualization layer, disabling the same ESXi protections GhostFrame targets and pulling domain controller credentials directly from virtual disk files — bypassing any security software running inside the guest entirely.

What Defenders Should Do Now

Because GhostFrame requires an attacker to already have root-level access to the ESXi host, the most effective defense is restricting who and what can reach hypervisor management interfaces in the first place. Security teams should:

• Limit ESXi management access to a small set of trusted, segmented management systems
• Monitor for unexpected changes to /etc/rc.local.d/local.sh and new files appearing under /opt
• Watch for repeated, automated toggling of the host firewall or execInstalledOnly setting
• Flag outbound connection bursts to six ports in immediate succession from hypervisor hosts
• Patch internet-facing VPN appliances promptly, since several recent intrusions began there

Insikt Group says it cannot confirm whether GhostFrame is exclusive to the Settra operation or is being more widely shared among ransomware affiliates, but it assesses it as highly likely that other financially motivated groups will adopt GhostFrame or similar tooling. Organizations that still treat their hypervisors as background infrastructure rather than as crown-jewel systems may want to reconsider — on the evidence so far, attackers increasingly see ESXi hosts as a faster route to total control than attacking each virtual machine one at a time.