A newly identified cybersecurity threat, known as GhostFrame, has emerged as a significant risk to VMware ESXi servers. This malicious framework, detected by Recorded Future’s Insikt Group, provides hackers with a centralized control panel to hijack virtual machines and extract Windows credentials without deploying internal software.
GhostFrame’s Target and Mechanism
GhostFrame primarily targets ESXi, a hypervisor that facilitates the operation of multiple virtual machines on a single physical server. By gaining control over this layer, attackers can access all systems beneath it. Unlike conventional exploits, GhostFrame does not rely on vulnerabilities; instead, it requires existing root access to the ESXi host.
The framework employs a web interface divided into ‘Sessions’ and ‘Builder’ sections. The ‘Builder’ generates an ESXi implant called vmhostd-core, which embeds itself into the system to persist through reboots, disabling crucial security features and firewall protections in the process.
Technical Operations of GhostFrame
Once active, GhostFrame attempts to communicate with its command server using multiple network ports simultaneously, including 53, 2222, 3389, 4444, 8443, and 9443. It maintains the first successful connection and disregards the others. This connection method can provide a detectable pattern for cybersecurity defenses.
The implant executes code directly in memory, avoiding disk writes, and can fall back to a simple reverse shell if necessary. GhostFrame facilitates comprehensive control over virtual machines, allowing for power state changes, snapshot management, and remote screen access via VNC.
Credential Theft and Wider Implications
GhostFrame’s most concerning aspect is its ability to steal credentials. The sdkmon component alters ESXi service configurations to capture login details, while the VMkatz tool extracts sensitive data from VM snapshots and virtual disk images. This enables attackers to obtain a wide range of Windows credentials without deploying malware within the VMs themselves.
The Insikt Group’s analysis links GhostFrame to the activities of TAG-218, a group associated with Settra ransomware. The group has been observed exploiting VPN vulnerabilities in prominent products, leading to infiltration and subsequent data theft, aligning with previous attacks utilizing the CVE-2026-0257 vulnerability.
Mitigation and Future Outlook
To mitigate the risks posed by GhostFrame, organizations should restrict access to ESXi servers, monitor for unauthorized root logins, and scrutinize system files for unexpected alterations. Network logs should be analyzed for patterns indicative of GhostFrame’s connection attempts.
As the cybersecurity landscape evolves, GhostFrame exemplifies the growing sophistication of threats targeting virtualization technologies. It is crucial for organizations to prioritize hypervisor security and integrate threat intelligence to preemptively address potential incidents.
