A new hacking toolkit called GhostFrame gives criminals a single control panel for taking over VMware ESXi servers and the virtual machines that run on them.
Researchers at Recorded Future’s Insikt Group found the framework while tracking a group named TAG-218, whose activity overlaps with Settra ransomware. The tool can also pull Windows passwords out of hosted machines without ever running a program inside them.
The key point is where GhostFrame works. ESXi is a hypervisor, the layer that runs many virtual machines on one physical server. If a criminal controls that layer, they can reach every system on it.
Security tools inside each virtual machine often cannot see what is happening below them. Insikt Group’s report says the framework does not exploit a bug to get in. The operator must already have root access to the ESXi host.
GhostFrame Stays on the Server
The framework has a web panel with two sections, “Sessions” and “Builder.” The builder creates…
