TL;DR Security researchers at Recorded Future uncovered a new post-exploitation tool called the GhostFrame ESXi implant targeting virtualized enterprise infrastructure. Threat actors tracked as TAG-218 deploy the GhostFrame ESXi implant Settra ransomware toolkit after breaching perimeter VPN appliances to control hosted virtual machines from the hypervisor layer. According to Recorded Future, at least four targeted organizations later appeared on the Settra ransomware extortion portal.