Settra Ransomware Hits Retail and Manufacturing

A ransomware variant tracked as Settra has been used in intrusions against retail and manufacturing organizations, according to research from security firm Huntress. The variant was first observed in June, and the firm's researchers documented post-compromise techniques in an attack on a consumer services and retail organization in July and a manufacturing firm in September.

The two cases share a recognizable playbook: remote monitoring and management tooling installed for persistent access, deliberate steps to disable a victim's recovery options, and, in the September incident, a bring your own vulnerable driver (BYOVD) component. Huntress published its account of the activity in a blog on September 17.

How the July Intrusion Unfolded

In the July attack against a retail organization, the threat actor installed the MeshAgent RMM in the victim's environment. According to Huntress, that tooling connected to an IP address linked to command-and-control (C2) infrastructure.

The following day, the ransomware executable was launched from the C:\Perflogs folder. Files were encrypted and renamed with the .locked file extension, and a ransom note was created.

EDR telemetry showed that immediately after the executable ran, the attacker moved to prevent the victim organization's recovery. The steps included clearing several Windows Event Logs, disabling the Windows Recovery Environment, running ipconfig /flushdns to flush the DNS cache, and using a script to run the native Windows diskpart utility to remove a recovery partition.

The attacker also ran the command cmd.exe /c cipher /w:D:\ >nul 2>&1, invoking the native Windows cipher utility to overwrite free space on multiple file volumes and make deleted data harder to recover.

The September Attack Adds a Driver

In the September incident against a manufacturing organization, Huntress said similar techniques appeared. The MeshAgent RMM was installed, and recovery options were disabled once the ransomware executable was launched.

The notable addition was BYOVD. These drivers can be installed for a range of purposes, including affecting onboard security tooling and crashing services related to antivirus applications.

One attacker action failed: the researchers noted that the threat actor misspelled one of the Windows Event Logs they were attempting to clear, stopping that step from being carried out. The workstation name WIN-LIVFRVQFMKO was associated with the malicious activity in the September incident, a name Huntress had previously observed in other incidents going back to December 2024.

Naming, C2 and Shared Conduct

In both incidents, the ransomware executable was named for the impacted organization's domain name, appended with _win64.exe.

Huntress said there were slight differences between the two cases, such as the naming and C2 IP address of the MeshAgent RMM and the folders the threat actors operated from. The overall conduct of the attacks, however, was remarkably similar.

"While there were slight differences between the two incidents, such as the naming and C2 IP address of the MeshAgent RMM, as well as the folders the threat actors operated from, the overall conduct of the attacks were remarkably similar," the researchers wrote.

— Huntress researchers

No Confirmed Initial Access

Huntress said it was unable to confirm how the attackers gained initial access for the two incidents. That leaves the entry point for both intrusions unresolved in the firm's account.

Previous research on Settra showed the variant was used for double-extortion tactics, with attackers threatening to release sensitive corporate information alongside encrypting systems. Several key data points from the Huntress report stand out:

• Settra was first observed in June
• The retail attack occurred in July; the manufacturing attack in September
• The workstation name WIN-LIVFRVQFMKO was previously observed in incidents going back to December 2024
• Files were renamed with the .locked extension
• Ransomware executables were named with the victim's domain name plus _win64.exe

Huntress also noted that there is currently not enough evidence to state that Settra is a ransomware-as-a-service (RaaS) operation.

What Defenders Are Told to Watch

The researchers noted that new ransomware variants emerge frequently, each with their own distinct tactics, techniques and procedures (TTPs). They urged security teams to stay up to date with these variants and with the post-compromise techniques used to help detect and respond to such attacks.

Defenders should also continue to focus on the "fundamentals" of cyber defense to prevent these attacks occurring, the blog added.

Read now: A New Ransomware Threat Actor Emerges Every Week, Warns Report

The Recovery-Sabotage Pattern

Across both incidents, the attacker's post-encryption activity targeted the victim's ability to restore systems. Clearing Windows Event Logs, disabling the Windows Recovery Environment, flushing the DNS cache, removing a recovery partition via diskpart, and overwriting free space with cipher all appeared in the documented telemetry.

In the September case, the addition of BYOVD extended the disruption to security tooling and antivirus-related services on the impacted systems. The misspelled Event Log name meant one intended deletion did not go through.

Why the Similarities Matter

The shared elements across the two intrusions — MeshAgent RMM, recovery sabotage, victim-named executables and consistent folder use — give defenders a set of behaviors to look for.

Huntress tied the September activity to a workstation name it had seen before, dating back to December 2024. That association is one of the few threads in the report that connects the current incidents to earlier activity the firm has observed.

The firm's account does not confirm initial access, does not attribute the activity to a named group, and stops short of calling Settra a RaaS operation.

What This Means for Businesses

The two documented incidents show an attacker willing to spend time after encryption on disabling recovery, not just locking files. For organizations in retail and manufacturing, the practical implication is that backup and restore assumptions may not hold if the same techniques are used against them — this could mean recovery takes longer than a standard ransomware response plan anticipates, though the source material does not establish how common these techniques are across the wider threat landscape.

Huntress's guidance points defenders toward tracking new variants and their post-compromise behavior, alongside the fundamentals of cyber defense. Given that the entry vector for both incidents remains unconfirmed, detection efforts that key on the encryption event alone would miss the earlier stages the firm described, including the RMM connection to C2 infrastructure the day before encryption in the July case.