SETTRA Ransomware Deploys MeshAgent and gdrv.sys BYOVD Against Windows Systems

Huntress researchers have detailed two incidents involving a previously undocumented ransomware strain named SETTRA that targets Windows systems by combining a legitimate remote administration tool with a vulnerable driver.

The first victim, a consumer services and retail company, was compromised in July, while the second victim, an industrial organization, was hit in September. Initial access was obtained via VPN or previously stolen credentials, although the exact initial infection vector remains unconfirmed.

Once inside the network, operators deployed MeshAgent, a legitimate remote monitoring and management tool. This allowed them to maintain control, run commands, and move laterally while reducing reliance on custom malware that could trigger detections.

The second key component is the BYOVD technique. In the September incident, attackers loaded the vulnerable driver gdrv.sys to disable security services prior to encryption.

Before beginning the encryption process, the group took several steps to hinder recovery: Windows event logs were cleared, system recovery was disabled, recovery partitions were removed, and free disk space was overwritten.

Encrypted files were appended with the .locked extension in the first case and .locked_wip in the second. The ransomware executable itself was named after the victim’s domain, and ransom notes titled RESTORE_FILES.txt were placed in multiple directories.

Huntress recommends protecting VPN access with strong authentication, restricting remote management tools, maintaining tested offline backups, centralizing Windows log collection, and conducting simulated incident response exercises.