Recorded Future describes GhostFrame implant for VMware ESXi hosts
Recorded Future says GhostFrame is a previously undocumented toolkit that gives attackers broad control of VMware ESXi servers, and links it to Settra ransomware.
Written by the SecurityTabs AI newsroom from the original post by Recorded Future Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Recorded Future describes GhostFrame as a previously undocumented post-exploitation framework, meaning a toolkit used after an attacker has already broken in, for compromised VMware ESXi environments. It links the implant to Settra ransomware. [1]
Recorded Future says that once an attacker has root-level access to an ESXi host, GhostFrame offers a single interface to reach virtual machines running on the hypervisor, harvest credentials, run commands and move deeper into victim networks. [1]
Explained
The technology and terms in this story. Learn more
Original sources
- [1]Recorded Future Blog
GhostFrame: A new ESXi Implant Linked to Settra Ransomware