Incident Responder: 2026-09-19

1. Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM

   Huntress, 2026-09-17. Read, 14 min.

   Huntress investigated two intrusions deploying the Settra ransomware variant, one in July at a retail and consumer services firm and one in September at a manufacturer, with MeshAgent RMM installed in both. Commands embedded in the ransomware executable cleared Windows Event Logs and disabled the Windows recovery environment in both cases, and initial access was not confirmed in either.

   Why it matters for this role: Assume host logs are gone and plan collection around what survives, such as memory, endpoint telemetry and network records, and add MeshAgent to your persistence checklist so eviction is not declared early. Initial access was not confirmed in either case, so you own the VPN and credential question in your own timeline.

   Corrected 2026-09-21: An earlier version presented one fixed sequence of anti-forensics commands, all run before encryption. Huntress saw the cipher overwrite in one incident only, assesses recovery-partition removal from a script it could not recover, and does not say the commands ran before encryption. A first revision on 2026-09-21 carried no note.

Incident Responder