threat actor · Origin not attributed
Settra
1 CVE exploited (1 in CISA KEV)
1 article this week: GhostFrame implant enables Settra ransomware attacks on ESXi
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open Settra's actor pageSettra is a ransomware actor reported by Huntress in attacks on retail and manufacturing organisations, with operators using double extortion. Recorded Future’s Insikt Group reported Settra ransomware attacks involving a GhostFrame implant on ESXi, while ReliaQuest associated Settra activity with exploitation of CVE-2026-0257. No origin attribution is on record.
Source: CyberSIXT summary, 14 November 2026. Written by CyberSIXT's model from CyberSIXT's own article summaries and records, and checked against them; read the articles before relying on it.
- Origin
- Not attributed
- On record in
- CyberSIXT
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.