Settra Ransomware Abuses RMM Tools for Persistence While Sabotaging Recovery
The Settra ransomware strain demonstrates how attackers leverage legitimate Remote Monitoring and Management (RMM) tools like MeshAgent to establish persistence, effectively blending into normal IT operations and evading detection. By disabling recovery environments and using Bring Your Own Vulnerable Driver (BYOVD) techniques, attackers ensure victims have limited options for remediation without paying. The deliberate clearing of Windows Event Logs highlights a calculated effort to destroy forensic evidence and hamper incident response — a tactic that ironically backfired in one case due to a typo, underscoring the importance of centralized, tamper-resistant logging. This incident illustrates why organizations must treat RMM tools as high-risk vectors and actively monitor for their unauthorized installation or misuse.
Tactical Insight
Immediate actions
- Audit all installed RMM tools across your environment and block unauthorized agents like MeshAgent using application allowlisting.
- Enable centralized, offsite log aggregation (e.g., a SIEM) so that local event log clearing cannot eliminate forensic evidence.
- Verify that Windows Recovery Environments and Volume Shadow Copies are intact and protected from unauthorized deletion.
Long-term improvements
- Implement a formal RMM tool policy that restricts approved vendors, enforces MFA, and requires justification for any new agent deployment.
- Apply driver allowlisting and Vulnerable Driver Blocklist policies (e.g., Microsoft HVCI) to prevent BYOVD-based security tool evasion.
- Maintain immutable, offline backups tested regularly for restoration integrity to ensure ransomware cannot eliminate all recovery paths.
Detection measures
- Create alerting rules for suspicious renaming of executables to match internal domain names, a known Settra obfuscation tactic.
- Monitor for mass event log clearing commands (e.g., `wevtutil cl`) and treat any such activity as a high-priority incident signal.
- Deploy behavioral detection controls that flag processes attempting to disable VSS, bcdedit recovery settings, or endpoint security services.