Dominic Jainy has built a distinguished career at the intersection of infrastructure security and emerging technology, focusing on how sophisticated threat actors exploit the very tools designed to protect us. As an expert in machine learning and blockchain, he has a unique vantage point on the evolving tactics used by ransomware groups to maintain persistence within high-stakes environments. Recently, the emergence of the Settra ransomware variant has highlighted a trend where “capable” hackers prioritize effective tradecraft over complex exploits. In this discussion, Jainy explores how Settra leverages compromised credentials and legitimate management software to cripple organizations in the retail and manufacturing sectors.
How do compromised VPN credentials typically serve as the gateway for variants like Settra, and what does this reveal about the current state of access management in 2026?
It often starts with a single point of failure that feels almost mundane—a set of leaked or weak VPN credentials that haven’t been properly rotated or protected by robust multi-factor authentication. In the two specific attacks observed in July and September of 2026, Settra leveraged these gaps to walk right through the front door of a consumer services firm and a manufacturing plant. This isn’t necessarily about high-level zero-days; it’s about a “capable” attacker who understands that many organizations still struggle with unpatched systems and lax credential hygiene. Once they gain that initial foothold, the transition from a simple login to a full-scale deployment happens with alarming speed, proving that the digital perimeter is only as strong as its weakest set of user permissions. It’s a sobering reminder that even the most advanced security stacks can be bypassed if the “keys to the kingdom” are left under the doormat.
Once an attacker is inside, the use of tools like MeshAgent seems pivotal; how do these legitimate remote monitoring and management tools become a weapon for maintaining persistence?
Attackers are increasingly fond of “living off the land,” and the July incident provided a perfect example when they deployed MeshAgent and renamed it mvtcs.exe to blend in with standard system processes. This renamed executable acts as a silent beacon, phoning home to a command-and-control address while the IT staff remains completely unaware of the ghost in their machine. It is a gut-wrenching realization for a security team to find that the very tools they use to manage their fleet are being used to encrypt it. By the time the ransomware executable is launched the following day, the environment is already fully compromised, and the encryption process feels like a mere formality after the groundwork for persistence has been so thoroughly laid.
In the September attack, researchers noted the “Bring Your Own Vulnerable Driver” (BYOVD) tactic—how does this specific technique complicate the response for on-site security teams?
The BYOVD tactic is particularly nasty because it effectively blinds the security stack from the inside out by using a driver with known vulnerabilities to impact onboard security tools. During the September breach, hackers used this method to impair defenses before they began the heavy lifting of clearing Windows Event Logs and disabling the Windows Recovery Environment. There is a specific kind of frustration that sets in for a defender when they realize the recovery partitions have been removed, leaving them with no local safety net. By the time the ransomware executable—often named after the victim organization’s own domain—is triggered, the attackers have already systematically dismantled every “undo” button the system had.
The fact that hackers are naming executables after the victim’s domain suggests a high level of intentionality; what are the psychological and operational implications of this personalized methodology?
There is a calculated, almost personal cruelty in naming a malicious file after the organization it is in the process of destroying. This isn’t just a naming convention; it’s a branding exercise for the Settra group, which they reinforce by posting victim organizations on their dedicated shaming site to increase the pressure. When a manufacturing firm sees its own domain name as the catalyst for a system-wide shutdown, it adds a layer of professional embarrassment and urgency that is designed to force a quick ransom payment. It signals to the victim that the attacker hasn’t just stumbled into the network but has taken the time to understand exactly who they are and what they stand to lose, making the threat feel much more intimate and targeted.
What is your forecast for the evolution of ransomware tactics like Settra’s throughout the rest of 2026?
As we move through the latter half of 2026, I expect to see an even greater reliance on the exploitation of legitimate RMM tools because they are so effective at bypassing automated detection systems. We are likely to see more “capable” groups—those who aren’t necessarily inventing new exploits but are masters of execution—targeting mid-sized firms that lack the resources for 24/7 proactive monitoring. The focus will continue to shift toward total environmental destruction, where recovery partitions and backup environments are the primary targets to ensure the victim has zero leverage during negotiations. Security teams must prioritize hardening their VPNs and monitoring for the unauthorized use of management tools like MeshAgent if they want to stay ahead of this increasingly aggressive curve.