New Settra ransomware variant hits retail and manufacturing

Huntress described a new Settra ransomware variant used against a retailer in July and a manufacturer in September. Attackers deployed the MeshAgent RMM tool, disabled Windows recovery features and used a vulnerable driver (BYOVD).

• Settra seen since June; attacks hit retail in July and manufacturing in September
• Files encrypted with .locked extension under a double extortion scheme
• Attackers cleared Windows logs, disabled Recovery Environment and wiped free space
• September attack also installed a vulnerable BYOVD driver