GhostFrame ESXi Malware: New Implant Lets Attackers With Root Control Every VM and Steal Domain Passwords, and How to Check Your Hosts

Recorded Future's Insikt Group has found GhostFrame, a new attack toolkit for VMware ESXi. An intruder who already has root on an ESXi host can use it to control every virtual machine on that host, steal Windows and domain passwords from them, and tunnel into the rest of the network. If your business runs its servers as virtual machines on ESXi, one stolen host login could hand over your file server, your domain controller and your backups all at once.

GhostFrame does not break into ESXi through a software flaw, so there is no patch for it. What protects you is who can reach your ESXi hosts, how their root accounts are guarded, and whether anyone is checking them for changes.

What is GhostFrame?

GhostFrame is a command-and-control framework, meaning a control panel plus an implant (a hidden program) that attackers leave on a server. Insikt Group found it while watching infrastructure run by a group it tracks as TAG-218. The panel has a "Sessions" area for managing hacked hosts and a "Builder" that makes new implants.

According to Recorded Future, the implant can:

• List every virtual machine on the host, turn them on or off, and create or delete snapshots
• Turn on VNC remote screen access to individual VMs and pass those sessions back to the attackers
• Expose the ESXi HTML Host Client (the web management page) through a tunnel the attackers control
• Run gfsox, a SOCKS5 proxy that routes attacker traffic through the hypervisor to internal systems
• Run VMkatz, an open-source tool that pulls NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets, and NTDS.dit credential data out of VM memory snapshots, virtual disks or a whole datastore

The panel also lists a component called sdkmon, described as a credential interceptor that changes ESXi service settings to capture usernames and passwords from later ESXi logins. Recorded Future notes that this comes from the panel's description, not from behavior it confirmed.

What is confirmed and what is not

How the attackers got in: VPN appliances

Recorded Future says TAG-218 went after VPN appliances in the US and Europe between late August and October 2026, mostly from SonicWall, Palo Alto Networks and Fortinet. On October 12, 2026, a victim's Fortinet VPN appliance was seen talking to both GhostFrame and MeshCentral servers. MeshCentral is a remote management tool that Huntress had earlier tied to Settra intrusions.

The report says this activity lines up with reporting on CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect. Palo Alto's advisory, published May 13, 2026, rates it High, marks it as attacked, and says it affects GlobalProtect portals or gateways that use authentication override cookies with a specific certificate setup. The report names no CVE for the SonicWall or Fortinet devices.

The pattern is familiar: get through the VPN, get root on ESXi, then take everything running on it.

How to check an ESXi host for GhostFrame

These checks come from the signs listed in Recorded Future's report. Run them from an ESXi shell or SSH session as an administrator.

The implant copies itself to /opt/vmhostd-core, adds itself to local.sh, runs /sbin/auto-backup.sh so the change survives a reboot, and turns off the ESXi firewall and the execInstalledOnly setting about every five seconds. That is why switching the firewall back on is not enough: it will be turned off again until the implant is removed. The six-port burst comes from the implant trying all six at once and keeping the first that answers, and Recorded Future says it can expose GhostFrame even after the attackers move to new servers.

Recorded Future also published these indicators. Search your firewall and DNS logs for them:

• 193.5.65.114 (TAG-218 MeshCentral server)
• 45.158.196.81 and 45.158.196.141 (GhostFrame servers)
• SHA-256 a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10 (GhostFrame sample)

What to do this week

1. Patch your VPN. If you run GlobalProtect, Palo Alto lists fixed versions including PAN-OS 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6 or later, plus hotfixes on older trains. Its workarounds are a dedicated certificate for authentication override cookies, or turning those cookies off. Bring SonicWall and Fortinet devices up to their vendors' current fixed releases too.
2. Take ESXi management off the open network. Only trusted admin machines should reach the host's web client and SSH. Turn SSH off when nobody is using it.
3. Guard root. Give each host its own strong root password, kept in a password manager rather than reused from the domain.
4. Run the checks above on every host, and add the six-port pattern to whatever watches your firewall logs.
5. If you find anything, assume every VM's credentials are stolen. VMkatz reads them from outside the VM, so reset domain and service account passwords and rebuild the host from clean media rather than cleaning it in place.
6. Keep a backup copy ESXi cannot touch. An attacker who can delete snapshots and power off VMs can reach backups stored on the same platform.

Why this matters for a company network

Virtualization saves money because one physical server runs many systems. It also means one compromise reaches all of them. Security software inside a Windows VM is watching that VM, not the hypervisor underneath it, so tools like VMkatz can lift domain credentials from a snapshot without the guest ever noticing. For a business, the ESXi host deserves the same protection as the domain controller, because whoever holds one can usually get the other.

GhostFrame questions people are asking

Is GhostFrame a VMware vulnerability?

No. Recorded Future says the implant exploits no flaw and needs root access the attackers already have.

Is there a patch for GhostFrame?

No, because it is not a bug. Patch the ways in, mainly VPN appliances, and lock down who can log in to ESXi.

Who is behind GhostFrame?

Recorded Future links it to TAG-218, whose activity overlaps with Settra ransomware. It says the evidence does not show GhostFrame is used only by Settra.

Can antivirus inside my virtual machines detect it?

Not reliably. GhostFrame runs on the hypervisor, beneath the guest operating systems. Check the host itself and the network traffic leaving it.

The bigger lesson

Attackers go for whatever controls the most systems, and in most server rooms that is the hypervisor. Keep it patched, unreachable from the open network and checked on a schedule, and keep one backup it cannot touch.

If you want your ESXi hosts and VPN reviewed, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Recorded Future Insikt Group: GhostFrame, a New ESXi Implant Linked to Settra Ransomware; Palo Alto Networks: CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass.