Recorded Future’s Insikt Group has identified GhostFrame, a previously undocumented post-exploitation framework that gives attackers control over compromised VMware ESXi hosts. The tool can manage multiple virtual machines, harvest credentials from guest systems and pivot deeper into victim networks from a single control panel. Researchers linked its use to TAG-218, whose activity overlaps with Settra ransomware.
GhostFrame does not exploit a vulnerability to gain entry. It requires existing root-level access to an ESXi host before it can be deployed. Unlike the guest-to-host escape shown in the Firecracker PwnEscape demonstration, GhostFrame does not provide its own route to host access. It is also distinct from the actively exploited Xen Orchestra authentication bypass, which can grant administrator access to XCP-ng hosts. Recorded Future observed TAG-218 targeting VPN appliances from SonicWall, Palo Alto Networks and Fortinet across the United States and Europe between late August and October 2026. Four targeted organizations later appeared on Settra’s leak site.
The implant installs under /opt/vmhostd-core and modifies the ESXi startup script /etc/rc.local.d/local.sh to persist after reboot. It repeatedly disables the ESXi firewall and the execInstalledOnly security control, which restricts unsigned binaries. It can also disguise itself as vmhostd, a name similar to VMware’s legitimate vmware-hostd daemon.
GhostFrame’s web control panel includes “Sessions” for managing connected hosts and “Builder” for generating implants. Operators can enumerate virtual machines, change their power states, create or delete snapshots, enable VNC access and expose the ESXi HTML Host Client through a tunnel. A SOCKS5 component named gfsox can route traffic through the compromised hypervisor to reach internal systems.
The framework also combines several credential-theft capabilities. Its sdkmon component can modify ESXi service configuration and intercept authentication traffic to capture credentials from later logins. Its integration with VMkatz can extract NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets, and data from NTDS.dit using guest memory snapshots or virtual disk images, without installing conventional credential-stealing malware inside each virtual machine.
The analyzed implant attempts simultaneous TCP connections to ports 53, 2222, 3389, 4444, 8443 and 9443, then uses the first successful connection for command-and-control traffic. Recorded Future said this can produce six near-simultaneous connection attempts to the same destination, creating a distinctive network pattern. On October 12, researchers observed a victim Fortinet VPN appliance communicating with both GhostFrame command-and-control infrastructure and a MeshCentral server associated with Settra activity.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Recorded Future said the activity aligns with separate Unit 42 reporting on attackers moving from compromised GlobalProtect VPN appliances to virtualization infrastructure, but did not say TAG-218 used CVE-2026-0257. Insikt Group said the available evidence does not show that GhostFrame is exclusive to Settra or explain how the framework is distributed.
