Executive Summary
Recorded Future's Insikt Group published research on 10 November 2026 about GhostFrame, a previously undocumented command and control and post-exploitation framework for VMware ESXi hosts. Operators need existing root access to the host. The implant does not exploit a vulnerability to get in.
Once running, the implant named vmhostd-core copies itself to /opt/vmhostd-core and edits the boot script /etc/rc.local.d/local.sh. That script repeatedly disables the ESXi firewall and the execInstalledOnly control, about every five seconds. The process presents itself as vmhostd to resemble VMware's vmware-hostd daemon.
The implant tries six TCP ports at once to reach its C2 server (53, 2222, 3389, 4444, 8443 and 9443) and runs the code it receives in memory. Operators can list and manage VMs, create or delete snapshots, enable VNC and run a SOCKS5 proxy named gfsox. The framework also integrates VMkatz to extract credentials from hosted Windows systems. The operator panel describes a component named sdkmon as a credential interceptor for ESXi logins.
Insikt Group links GhostFrame to TAG-218, whose activity overlaps with Settra ransomware operations. TAG-218 servers targeted VPN appliances from SonicWall, Palo Alto Networks and Fortinet between late August and October 2026. Four targeted organizations later appeared on the Settra leak site. The evidence does not show that GhostFrame is exclusive to Settra.