Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM

Huntress investigated two Settra ransomware incidents (July and September) affecting organizations in different sectors, observing MeshAgent RMM usage, embedded commands in the ransomware to disable recovery and clear many Windows event logs, and file encryption producing .locked and .locked_wip extensions with a RESTORE_FILES.txt note; the September event also showed a BYOVD (gdrv.sys) and C2 infrastructure ties (45.13.122.7 and 193.5.65.114).