New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems

Settra ransomware is emerging as a serious threat to Windows networks after investigators linked it to two recent intrusions involving remote-management software and recovery-blocking actions. The operation encrypts files, leaves victims with ransom notes, and tries to make both investigation and restoration more difficult. Public reporting indicates that the people behind Settra have gained entry through virtual private networks or previously stolen credentials. That makes exposed remote access and weak account controls a central concern, while the use of legitimate administration software reflects the wider misuse of remote management tools in intrusions. Analysts from Huntress identified two incidents, one affecting a...

Læs hele artiklen hos kilden.