Settra ransomware takes digital extortion further by deleting Windows recovery tools before encrypting files, leaving victims with almost no way to restore their data and security teams scrambling for solutions.
Settra ransomware goes beyond simply encrypting files. Its operators first remove Windows recovery options, making it nearly impossible for victims to restore their systems without paying the ransom.
Researchers at Huntress analyzed two recent Settra attacks: one in July against a consumer services and retail company, and another in September targeting a manufacturing firm. In both cases, the attackers deliberately erased every recovery method that could help organizations recover their data without paying.
How Settra blocks every recovery path
Settra's process is methodical. Attackers deploy the ransomware payload-named after the victim's domain with a `_win64.exe` suffix-then immediately work to disable system defenses. They clear Windows Event Logs, flush DNS caches, and, most importantly, run `reagentc /disable` to turn off the Windows Recovery Environment. This step alone prevents users from accessing built-in repair tools that might otherwise help restore their systems.
The sabotage continues. In the July attack, the group used DiskPart, likely through a script, to target the recovery partition. They also ran the Windows Cipher utility to overwrite free space on the D: drive, making forensic recovery much harder. Only after these steps does the ransomware encrypt files, adding `.locked` or `.locked_wip` extensions, and leave a ransom note named `RESTORE_FILES.txt` in every affected folder.
Settra ransomware has rapidly expanded its reach since June 2026, with over 70 confirmed victims across the U.S., Germany, the U.K., Canada, and Australia by mid-September. Its operators are not only encrypting data but also systematically disabling Windows recovery mechanisms, making traditional restoration methods ineffective.
Source
Turning legitimate tools into weapons
Settra's operators use legitimate software to blend in. In both attacks, they relied on MeshAgent, a remote monitoring tool, to keep access. In July, MeshAgent was disguised as `mvtcs.exe` and connected to a command-and-control server at 45.13.122[.]7. By September, the tool kept its original name and connected to 193.5.65[.]114, an address also found in its certificate and network logs. Huntress also saw the use of `gdrv.sys`, a vulnerable driver, as part of a bring-your-own-vulnerable-driver (BYOVD) tactic to undermine endpoint security and potentially crash antivirus software.
Earlier reports linked Settra to compromised VPNs and stolen credentials, but Huntress could not confirm how the attackers first got in during these incidents. What stands out is their focus on persistence and destruction after gaining access, not just encryption.
Indicators of compromise and links to other attacks
For defenders, the technical clues are clear. The IP addresses 45.13.122[.]7 and 193.5.65[.]114 are tied to MeshAgent's command-and-control servers in these cases. The ransomware's naming patterns, use of legitimate tools for malicious purposes, and aggressive wiping of logs and recovery options set it apart from more opportunistic threats.
This escalation in ransomware tactics mirrors trends seen in other malware families. As noted in a recent analysis of Mantax Otax, attackers are increasingly combining data destruction, surveillance, and extortion to maximize leverage over victims.
What's at stake for organizations and users
Settra's approach leaves organizations with few options. By the time files are encrypted and ransom notes appear, standard recovery methods-system restore, recovery partitions, forensic tools-are already gone. The only choices left are to pay the ransom or rebuild from scratch, assuming clean backups exist outside the compromised network.
Settra's campaign is a warning for anyone relying on default Windows recovery features as a last resort. Attackers are now erasing every escape route, not just encrypting data. The industry needs to strengthen backup strategies, watch for legitimate tools used suspiciously, and prepare for threats where recovery is not just difficult, but intentionally blocked. For Italian organizations, updated guidance from the Agenzia per la Cybersicurezza Nazionale stresses the need for offsite and immutable backups to counter these evolving ransomware threats.
