A newly identified ransomware variant called Settra has been used in attacks against companies in the retail and manufacturing industries, according to Huntress, which published its findings on September 17. The variant was initially spotted in June, and researchers documented distinct post-compromise methods employed by attackers deploying Settra in a July strike against a consumer services and retail organization, followed by a September incident at a manufacturing company. Earlier research demonstrated that Settra was leveraged for double-extortion tactics, with attackers threatening to publish confidential corporate data while simultaneously encrypting systems.

Huntress couldn't determine how the attackers secured their initial foothold in either case. During the July retail attack, the threat actor installed the MeshAgent remote monitoring and management tool in the victim's network, which connected to an IP address associated with command-and-control infrastructure. The following day, the ransomware executable launched from the C:\Perflogs folder, encrypting victim files and renaming them with the .locked extension before generating a ransom note. Endpoint detection telemetry revealed that immediately after launching the ransomware, the attacker cleared multiple Windows Event Logs, disabled the Windows Recovery Environment, used ipconfig /flushdns to flush the DNS cache, and ran the diskpart utility through a script to delete a recovery partition. Additionally, attackers executed cmd.exe /c cipher /w:D:\ >nul 2>&1 to launch the cipher utility, overwriting free space on several file volumes to complicate recovery of deleted data. The September manufacturing attack employed similar methods, including MeshAgent installation and recovery option disabling, but added the use of bring your own vulnerable driver, which can impact onboard security tools and crash antivirus-related services. The researchers observed that attackers misspelled one of the Windows Event Logs they attempted to clear, preventing that action from completing. The workstation name WIN-LIVFRVQFMKO was linked to the malicious activity during the September incident and had previously appeared in other incidents dating back to December 2024, Huntress reported. In both cases, the ransomware executable was named after the targeted organization's domain name, with _win64.exe appended.

The researchers noted that while the two incidents showed slight differences—such as the MeshAgent RMM naming and command-and-control IP address, as well as the folders used by threat actors—"the overall conduct of the attacks were remarkably similar." Huntress stated there isn't currently sufficient evidence to confirm whether Settra operates as a ransomware-as-a-service operation. The post-compromise techniques highlighted included deploying remote monitoring and management tools for persistent access, efforts to disable victims' recovery options, and installing bring your own vulnerable driver to affected systems.

The report urged security teams to stay current with emerging ransomware variants and the post-compromise techniques attackers use to help detect and respond to such incidents. New ransomware variants are frequently appearing, each bringing their own distinct tactics, techniques, and procedures, according to the researchers. Defenders should also continue prioritizing the fundamentals of cyber defense to prevent these attacks from happening in the first place. Organizations that neglect recovery planning and endpoint monitoring may find themselves particularly vulnerable as attackers refine methods to permanently erase recovery options before victims can respond. The emphasis on persistence tools and recovery destruction signals a shift toward maximizing negotiation leverage rather than speed alone.