SOC Analyst: 2026-09-19

1. Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM

   Huntress, 2026-09-17. Read, 14 min.

   Huntress investigated two intrusions deploying the Settra ransomware variant, one in July at a retail and consumer services firm and one in September at a manufacturer, with MeshAgent RMM installed in both. Commands embedded in the ransomware executable cleared Windows Event Logs and disabled the Windows recovery environment in both cases, and initial access was not confirmed in either.

   Why it matters for this role: Turn what Huntress observed into watch items for your shift: mass event log clearing, reagentc /disable, a cipher /w free-space overwrite, and diskpart run against a script file. Treat MeshAgent appearing on a host with no approved remote management tool as an escalation, not a note.

   Corrected 2026-09-21: An earlier version presented one fixed sequence of anti-forensics commands, all run before encryption. Huntress saw the cipher overwrite in one incident only, assesses recovery-partition removal from a script it could not recover, and does not say the commands ran before encryption. A first revision on 2026-09-21 carried no note.

SOC Analyst