Security researchers have uncovered a previously undocumented hacking toolkit called GhostFrame that takes over VMware ESXi servers and steals Windows passwords from the virtual machines running on them. The framework was identified by Recorded Future's Insikt Group while tracking a threat cluster known as TAG-218, whose activity overlaps with the Settra ransomware operation. It was reported on 10 November 2026.

Control from the hypervisor layer

ESXi is a hypervisor, the software layer that runs many virtual machines on a single physical server. Whoever controls that layer can reach every system on it, while security tools inside each virtual machine often cannot see what is happening below them. GhostFrame is built to exploit that position.

The framework is controlled through a web panel with two sections, Sessions and Builder. The builder creates an implant, an ELF binary named vmhostd-core, which copies itself to /opt/vmhostd-core and edits the boot script /etc/rc.local.d/local.sh so it starts again after every reboot. It also switches off the ESXi firewall and the execInstalledOnly setting, which normally blocks unsigned programs, repeating the change about every five seconds. The implant renames itself vmhostd to resemble VMware's genuine vmware-hostd service.

Stealing passwords without touching the guest

Once connected, the implant loads code directly into memory and runs it without writing files to disk. An operator can list virtual machines, change their power state, create or delete snapshots, switch on remote screen access, and send traffic through the host using a SOCKS5 proxy tool called gfsox.

The credential theft features are the most serious part. A component called sdkmon alters the ESXi service setup and captures the usernames and passwords of later ESXi logins. GhostFrame also bundles VMkatz, an open-source tool that pulls secrets from virtual machine memory snapshots, virtual disk images or a scan of every virtual machine on a datastore. The data it can recover includes NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets, and NTDS.dit data. In short, an attacker can steal Windows passwords from outside the guest, with no malware installed inside it.

Link to VPN attacks and Settra ransomware

Insikt Group watched TAG-218 servers target VPN appliances in the United States and Europe between late August and October 2026, mainly products from SonicWall, Palo Alto Networks and Fortinet. Four of the targeted organisations later appeared on the Settra ransomware leak site. On 12 October 2026, a Fortinet VPN device was seen contacting both GhostFrame command servers and a MeshCentral server used to maintain access. Huntress had previously linked MeshCentral to Settra intrusions.

The timing also matches reported abuse of CVE-2026-0257, a flaw in Palo Alto Networks GlobalProtect that lets someone open a VPN session without valid credentials, although Insikt Group did not say TAG-218 used that flaw. The researchers said it is not known whether GhostFrame is used only by Settra or how it is shared, but they assessed it as highly likely that other financially motivated criminals will use GhostFrame or similar tools.

What defenders should check

GhostFrame does not break into a server on its own. It is a post-exploitation framework, so an operator must already have root access to the ESXi host before it can be deployed. That makes the hypervisor itself the asset to protect: management access should be limited to trusted systems, and administrators should watch for unexpected root logins, edits to /etc/rc.local.d/local.sh, new files under /opt, and repeated firewall or execInstalledOnly changes.

Network logs can also help. The implant tries six ports at the same time to reach its command server, 53, 2222, 3389, 4444, 8443 and 9443, keeping the first connection that works. A burst of six near-simultaneous connection attempts from one ESXi host to one address is a useful clue. VPN devices should be patched promptly, and hypervisors should be given the same close attention as domain controllers.