GhostFrame: A new ESXi Implant Linked to Settra Ransomware

Summary GhostFrame is a previously undocumented post-exploitation framework that gives threat actors extensive control over compromised VMware ESXi environments. Once an attacker gains root-level access to an ESXi host, GhostFrame provides a single interface to access virtual machines running on the hypervisor, harvest credentials, execute commands, and pivot deeper into victim networks.

Summary from Recorded Future Blog.

Explained

The technology and terms in this story. Learn more

More in Endpoint