GhostFrame is a newly identified post-exploitation framework that enables attackers to control VMware ESXi environments once they have obtained root access. The framework allows extensive interaction with multiple virtual machines from a single interface, facilitating credential harvesting and deeper network penetration.
The Insikt Group has linked GhostFrame to TAG-218, a threat actor group associated with Settra ransomware. However, GhostFrame itself does not exploit vulnerabilities to gain access; it requires root-level access to deploy its implant.
Kaspersky GERT has reported recent ransomware incidents in ESXi and Proxmox environments, emphasizing the risks posed by misconfigurations and weak access controls.
The discovery of GhostFrame underscores the critical nature of protecting hypervisors.