New

Chaos Ransomware Escalates: Express Employment Professionals Data Enters Public Release Phase As Settra Reveals A Stealthier Attack Playbook + Video

Chaos Ransomware Escalates: Express Employment Professionals Data Enters Public Release Phase as Settra Reveals a Stealthier Attack Playbook
A New Ransomware Warning for the U.S. Professional Services Sector

Ransomware continues to evolve beyond simple file encryption. Modern operators increasingly combine data theft, extortion, legitimate remote-management software, anti-recovery techniques, and attempts to erase forensic evidence. Two developments highlighted on September 17, 2026, illustrate that shift from different angles: Chaos has moved Express Employment Professionals into a public-release phase, while Huntress has documented two Settra ransomware incidents involving MeshAgent RMM, recovery inhibition, log clearing, and possible Bring Your Own Vulnerable Driver activity.

Chaos Targets Express Employment Professionals

Chaos has announced that it has begun publicly releasing data associated with Express Employment Professionals, a U.S. professional-services organization operating in the staffing and employment sector. A ransomware tracking source independently lists expresspros.com under Chaos on September 17, 2026, in the U.S. professional-services category.

The Public Release Phase Changes the Risk

The significance of a public leak is different from the initial appearance of a victim on a ransomware site. Once stolen information begins circulating publicly, organizations have to consider not only operational disruption but also privacy exposure, fraud, phishing, identity abuse, regulatory obligations, and potential secondary targeting.

Employment and staffing organizations can be particularly attractive targets because their business operations can involve information relating to workers, applicants, employers, payroll processes, recruiting activities, and business contacts. The exact categories and volume of information involved in the Express Employment Professionals incident have not been independently established in the sources reviewed for this article.

Communication Failure Is Part of the Ransomware Story

The original report states that Chaos moved toward public disclosure after attempts to communicate with Express Employment Professionals leadership received no response. That detail comes from the threat actor’s own publication and should therefore be treated as an attacker-provided explanation rather than an independently confirmed account of the company’s internal communications.

Express Employment Professionals Remains Publicly Active

Express Employment Professionals’ official newsroom was still publishing company material in September 2026. Its September 14 newsroom entry discussed National Staffing Employee Week, while other September publications covered workforce and employment topics. Those public updates establish that the company maintained an active public communications presence around the time of the reported ransomware disclosure, but they do not by themselves confirm the organization’s internal cybersecurity status or response to the incident.

Why Staffing Companies Hold Valuable Data

Staffing companies occupy an unusual position inside the information ecosystem. They can connect employers, job candidates, temporary workers, recruiters, payroll operations, and business partners.

That creates a potentially valuable combination of personal and organizational information. Even when attackers cannot immediately monetize every stolen file, leaked employment-related documents can become useful material for phishing, impersonation, business email compromise, social engineering, and identity-related fraud.

Chaos Demonstrates the Pressure of Double Extortion

The incident also reflects the continuing importance of the data-extortion model. Instead of depending entirely on encryption to force payment, ransomware operators can use stolen information as leverage.

The public-release stage is particularly important because it can turn a private negotiation into a long-term exposure problem. Even if systems are restored, the stolen data may remain outside the victim’s control.

A Second Ransomware Story Emerges With Settra

While Chaos was associated with the Express Employment Professionals incident, Huntress published a detailed investigation into two Settra ransomware incidents observed in July and September 2026. Huntress describes Settra as a newer ransomware variant first observed in June 2026.

Settra Uses Legitimate Administration Tools

One of the strongest lessons from the Settra investigation is the use of MeshAgent, a legitimate remote monitoring and management tool, during the intrusions.

In the July incident, Huntress observed MeshAgent renamed to mvtcs.exe. In the September incident, the MeshAgent installation was not renamed. Huntress linked the observed instances to different infrastructure, demonstrating how attackers can modify their tooling choices while preserving the broader operational pattern.

Why RMM Abuse Is Dangerous

Remote-management software is powerful because it is designed to administer systems remotely. That same functionality can become extremely useful to an attacker after initial compromise.

Security teams therefore cannot automatically classify a remote administration tool as harmless simply because it is legitimate software. Context matters, including who installed it, where it was executed from, what account launched it, which external addresses it contacted, and whether its presence matches the organization’s approved software inventory.

Settra Attempts to Destroy Recovery Options

Huntress observed Settra executing commands designed to interfere with recovery. These included reagentc.exe /disable, which disables the Windows Recovery Environment, and the use of diskpart.exe against a script that Huntress assessed was likely intended to remove a recovery partition.

This is an important ransomware tactic because attackers understand that recovery capability can reduce the pressure created by encryption.

Attackers Also Target Windows Event Logs

In the September Settra incident, Huntress observed attempts to clear multiple Windows Event Logs, including Application, Security, System, PowerShell, WinRM, Task Scheduler, Defender, Sysmon, and remote-desktop-related logs.

Clearing logs does not necessarily erase every trace of an intrusion, but it can make reconstruction substantially harder. For defenders, this reinforces the value of forwarding important security telemetry to systems attackers cannot easily modify from a compromised endpoint.

A Mistake Left One Defender Log Behind

One of the more unusual details in the Huntress investigation was an attacker spelling the Windows Defender event-log path incorrectly. Because of that error, the Defender operational log was not cleared.

This is a useful reminder that even sophisticated attacks can contain operational mistakes. Defensive monitoring should therefore remain active during an incident rather than assuming that attackers have successfully removed all evidence.

Possible BYOVD Activity Raises the Stakes

Huntress also identified signals consistent with Bring Your Own Vulnerable Driver activity during the September Settra incident, involving gdrv.sys. BYOVD techniques can allow attackers to abuse vulnerable signed drivers in an attempt to interfere with security controls or gain additional privileges.

The presence of BYOVD indicators makes endpoint visibility especially important because traditional application-level monitoring may not fully capture what is happening at the driver level.

Settra’s Ransomware Executables Follow a Pattern

Huntress found another interesting similarity between the two incidents. The ransomware executable was named after the affected organization’s domain and appended with _win64.exe.

This type of naming convention can potentially help defenders develop detection logic, particularly when combined with unusual execution locations, ransomware extensions, ransom-note filenames, and suspicious administrative utilities.

Encryption Was Only One Part of the Attack

In the July incident, encrypted files received the .locked extension. In the September incident, files received .locked_wip, with RESTORE_FILES.txt appearing as the ransom note in both cases.

These indicators are useful, but organizations should not wait for mass encryption before considering an incident active. The most valuable detection window may occur earlier, when attackers are installing RMM software, disabling recovery, moving laterally, or attempting to manipulate security telemetry.

Ransomware Is Becoming More Patient

Huntress’ broader 2026 reporting describes a shift toward attackers spending more time inside environments before reaching the ransom stage. Its report highlights the importance of detecting reconnaissance, identity abuse, lateral movement, and other pre-encryption behavior.

That changes the defensive mindset. A ransomware defense strategy should not focus exclusively on detecting ransomware binaries. It should also detect the behaviors that make ransomware deployment possible.

What Undercode Say:

1. The Express Incident Shows the Second Life of Stolen Data

The most concerning aspect of a public ransomware release is that recovery from encryption does not necessarily end the incident.

2. Data Extortion Can Outlive the Technical Recovery

A company can restore servers, rebuild endpoints, and reset credentials while stolen information remains outside its control.

3. Staffing Data Has Multiple Abuse Paths

Employment-related information can potentially support phishing, impersonation, fraud, and targeted social-engineering campaigns.

4. The Chaos Disclosure Needs Careful Verification

The public-release event is supported by multiple ransomware-tracking sources, but the attacker’s explanation about failed communication should remain attributed to Chaos.

5. The Settra Investigation Provides Stronger Technical Evidence

Unlike a ransomware leak-site statement,

6. RMM Abuse Is Becoming a Major Defensive Problem

Attackers do not always need custom remote-access malware when legitimate administrative tools can provide similar capabilities.

7. MeshAgent Deserves Contextual Monitoring

The presence of MeshAgent alone should not automatically be treated as malicious.

8. The Installation Context Matters

Security teams should ask whether MeshAgent is authorized, who installed it, where it originated, and what infrastructure it communicates with.

9. Renaming Legitimate Tools Can Hide Their Purpose

The July Settra activity showed MeshAgent renamed as mvtcs.exe, illustrating how attackers can attempt to make legitimate software less recognizable.

10. Recovery Systems Are Now Explicit Targets

Commands that disable Windows recovery demonstrate that attackers understand the importance of backup and restoration mechanisms.

11. Backups Need Isolation

A backup that can be modified or deleted from the compromised production environment is not equivalent to an isolated recovery copy.

12. Event Logs Are Security Assets

Logs should be treated as evidence that must survive endpoint compromise.

13. Centralized Logging Reduces Endpoint Dependence

Forwarding telemetry to protected infrastructure can preserve evidence even when an attacker attempts to clear local logs.

14. BYOVD Is a High-Impact Technique

A vulnerable driver can give an attacker capabilities that are difficult to achieve through ordinary user-mode processes.

15. Driver Monitoring Should Be Part of EDR Strategy

Security teams should investigate unexpected driver installations and unusual driver-loading behavior.

16. Small Attacker Mistakes Can Become Detection Opportunities

The misspelled Defender log path in the Settra incident is a practical example.

17. Attackers Are Not Infallible

Even organized ransomware operations can contain errors, incomplete cleanup, or inconsistent tooling.

18. Defenders Should Hunt for Behavior

Static indicators can change quickly, while attack behaviors often remain recognizable.

19. Ransomware Detection Must Begin Before Encryption

An endpoint installing unauthorized RMM software may be more valuable to investigate than an endpoint that has already begun encrypting files.

20. Identity Monitoring Is Critical

Compromised credentials can provide attackers with legitimate-looking access that is harder to distinguish from normal activity.

21. Administrative Accounts Need Strong Controls

Privileged accounts should receive additional monitoring, strong authentication, and carefully limited permissions.

22. RMM Software Requires Governance

Organizations should maintain an approved inventory of remote-management applications.

23. Unknown RMM Installations Deserve Immediate Attention

Unexpected remote-access tooling should trigger investigation, particularly when combined with unusual network connections.

24. File Extensions Can Help Detection

.locked and .locked_wip are useful Settra indicators, but they should supplement behavioral detections rather than replace them.

25. Ransom Notes Are Also Indicators

RESTORE_FILES.txt can provide a useful forensic clue when combined with other Settra artifacts.

26. Command-Line Telemetry Matters

Commands such as reagentc, diskpart, and cipher can become highly valuable behavioral signals in the right context.

27. Security Teams Should Protect Their Own Telemetry

Attackers increasingly understand exactly which logs defenders depend on.

28. Professional Services Remain Attractive Targets

Organizations handling large volumes of business and personal information can provide attackers with multiple extortion opportunities.

29. Public Leak Sites Increase Downstream Risk

Once data becomes publicly accessible, unrelated criminals may attempt to reuse or redistribute it.

30. Customers and Employees Can Become Secondary Targets

Stolen organizational information can potentially be used to construct convincing social-engineering messages.

31. Incident Response Must Include Communications

A ransomware incident is not purely a technical event.

32. Legal and Privacy Teams May Need Early Involvement

The discovery of data theft can create obligations beyond system restoration.

33. Threat Intelligence Helps Connect Separate Events

Infrastructure, filenames, IP addresses, workstation names, and tooling can help analysts identify relationships across incidents.

34. Indicators Should Be Combined With Context

An IP address alone can become obsolete or shared, while a collection of related behaviors can provide stronger detection value.

35.

The two Settra incidents contained differences but also significant similarities.

36. Ransomware Groups Can Change Their Surface Appearance

Different filenames, folders, and configurations do not necessarily mean a completely different attack methodology.

37. Recovery Testing Is as Important as Backup Creation

Organizations should regularly verify that backups and recovery procedures work under realistic incident conditions.

38. Detection Should Focus on the Quiet Middle

The period between initial compromise and encryption can provide the greatest opportunity to stop ransomware.

39. Chaos and Settra Illustrate Different Parts of the Same Problem

Chaos demonstrates the consequences of data extortion, while Settra demonstrates the operational techniques attackers can use to reach the encryption stage.

40. The Main Lesson Is Visibility

Organizations cannot reliably stop what they cannot see. Endpoint telemetry, identity monitoring, network visibility, centralized logging, backup isolation, and rapid incident response remain critical layers in the ransomware defense model.

Chaos Is Associated With Express Employment Professionals on September 17, 2026

Multiple ransomware-tracking sources list expresspros.com as a Chaos victim in the United States professional-services sector on September 17, 2026. This independently supports the basic victim, group, sector, and date details in the original report.

Huntress Investigated Two Settra Incidents

Huntress confirms that it investigated two Settra ransomware incidents, one occurring in July and another in September 2026. The incidents affected organizations in different sectors and displayed several overlapping tactics.

MeshAgent Was Used During the Settra Incidents

Huntress documented MeshAgent RMM activity in both investigations. In July it was renamed mvtcs.exe, while the September incident involved an unrenamed MeshAgent installation.

Recovery Inhibition and Log Clearing Were Observed

Huntress documented the use of reagentc.exe /disable, activity involving diskpart.exe, and attempts to clear Windows Event Logs. These actions were part of the observed post-compromise behavior.

gdrv.sys Was Associated With Possible BYOVD Activity

Huntress identified signals indicating BYOVD activity involving gdrv.sys during the September Settra incident. The evidence supports describing this as observed evidence or an indication rather than claiming that every Settra attack uses BYOVD.

The Claim That Express Leadership Failed to Respond Is Not Independently Confirmed

The statement that Express Employment Professionals leadership did not respond comes from the ransomware publication described in the original report. Public sources reviewed here confirm the Chaos listing but do not independently establish the private communication history between the attackers and company leadership.

The Exact Quantity and Nature of Express Data Released Are Not Established Here

The available sources confirm the public-release phase but do not establish a verified number of compromised records or a complete inventory of exposed files. Any specific volume or data category should therefore be treated separately until supported by a reliable disclosure or investigation.

Prediction

(+1) More Ransomware Operations Will Abuse Legitimate RMM Software

The continued appearance of legitimate remote-management tools in ransomware incidents makes further RMM abuse a reasonable defensive expectation. Organizations should monitor these tools according to context rather than automatically trusting them.

(+1) Ransomware Detection Will Move Further Toward Behavioral Monitoring

Techniques such as recovery manipulation, event-log clearing, suspicious driver loading, and unauthorized remote administration create behavioral signals that can be detected before encryption.

(+1) Public Data Releases Will Create Longer Incident Lifecycles

When stolen information reaches public or semi-public distribution channels, the incident can continue after technical recovery because organizations may need to investigate downstream misuse and notify affected parties.

(-1) Endpoint-Only Detection Will Leave Important Gaps

If attackers can manipulate local logs, disable recovery mechanisms, and operate through legitimate administrative software, relying exclusively on endpoint-local evidence can reduce visibility during the most important stages of an intrusion.

(-1) Treating All RMM Activity as Trusted Creates a Blind Spot

Legitimate software can become an attacker-controlled access mechanism. Organizations that do not distinguish authorized from unauthorized RMM deployments may miss an important stage of ransomware activity.

Deep Anlysis with commands
Windows Event Log Monitoring

Administrators can inspect important Windows event logs with PowerShell:

 
Get-WinEvent -ListLog | 
Where-Object {$_.RecordCount -gt 0} | 
Select-Object LogName, RecordCount, IsEnabled

This provides a quick inventory of available logs and their current record counts.

Check Recovery Environment Status

Defenders can verify the Windows Recovery Environment configuration:

reagentc /info

Unexpected changes to recovery configuration should be investigated, particularly during a suspected ransomware incident.

Search for Suspicious RMM Software

 
PowerShell can be used to review installed applications and services:

 
Get-Service | 
Where-Object {$_.DisplayName -match 'MeshAgent|Remote|RMM|Management'} | 
Select-Object Name, DisplayName, Status, StartType

This is only a starting point because attackers can rename executables or services.

Search for Settra-Related Ransom Notes

Defenders can search endpoints for the observed ransom-note filename:

 
Get-ChildItem -Path C:\ -Filter "RESTORE_FILES.txt" -Recurse -Force -ErrorAction SilentlyContinue

Large environments should use EDR or centralized search instead of recursively scanning every endpoint.

Search for Suspicious File Extensions

A targeted investigation can look for the extensions documented by Huntress:

 
Get-ChildItem -Path C:\ -Recurse -Force -ErrorAction SilentlyContinue | 
Where-Object {$_.Extension -in '.locked','.locked_wip'} | 
Select-Object FullName, Length, LastWriteTime

The appearance of these extensions should be correlated with process execution, user activity, and network events before determining that ransomware is active.

Review Driver Inventory

Security teams can review installed drivers:

 
Get-CimInstance Win32_SystemDriver | 
Select-Object Name, DisplayName, State, StartMode, PathName |

Sort-Object Name

Unexpected drivers should receive additional investigation, especially if their installation coincides with security-tool failures.

Review Active Network Connections

Defenders investigating suspicious RMM activity can examine active connections:

 
Get-NetTCPConnection -State Established | 
Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess

Network indicators should be validated against current threat intelligence and organizational baselines rather than treated as malicious solely because an unfamiliar address appears.

Hunt for Recovery Manipulation

Organizations using EDR or SIEM platforms should create detections for suspicious execution of:

reagentc.exe
diskpart.exe
wevtutil.exe
cipher.exe

These utilities are legitimate Windows components, so detection logic should emphasize unusual combinations, parent processes, privilege levels, execution paths, and timing.

Monitor Event Log Clearing

A useful detection objective is identifying attempts to clear security-relevant logs. Depending on the environment, defenders should monitor for activity involving:

wevtutil

 
Clear-EventLog 
Remove-EventLog

The goal is not simply to block legitimate administration, but to identify unexpected use from compromised hosts or suspicious accounts.

Protect Logs From Endpoint Tampering

Security teams should forward important Windows telemetry to centralized infrastructure where possible. Logs stored only on a compromised endpoint may be modified or deleted by an attacker who gains sufficient privileges.

Hunt for Unauthorized MeshAgent Activity

Organizations that do not officially use MeshAgent should consider creating detections for its installation, execution, persistence mechanisms, and outbound communications.

Organizations that do use it should establish a known-good inventory so that defenders can distinguish legitimate administrative activity from unexpected deployments.

Protect Backups From Ransomware

Backup architecture should include isolation and access controls that prevent compromised production credentials from modifying every available recovery copy.

Regular restoration tests should also verify that backups are usable rather than merely confirming that backup jobs report success.

Investigate Before Encryption

The strongest response opportunity may appear before ransomware begins encrypting files. Suspicious RMM installation, credential abuse, security-log manipulation, recovery changes, and unusual driver activity can provide earlier warning.

Final Assessment

The September 17, 2026 developments involving Chaos and Settra demonstrate two connected realities of modern ransomware. Chaos illustrates how an intrusion can progress into public data exposure, while Huntress’ Settra investigation shows how attackers can use legitimate administration tools, recovery-disabling commands, log manipulation, and possible vulnerable-driver abuse to maintain control and prepare an environment for encryption.

For organizations, the practical lesson is clear: ransomware defense cannot begin when the ransom note appears. Visibility must exist throughout the intrusion, from identity and remote-access activity to endpoint processes, drivers, event logs, network connections, and backup infrastructure. The earlier suspicious behavior is detected, the more opportunities defenders have to interrupt the attack before encryption and public extortion become the dominant problems.

Tighten the 40-point analysis
Make Chaos and Settra converge sooner

‍Let’s dive deep and fact‑check.

Live Courses & Certifications:

[Join Undercode Academy for Verified Certifications](https://undercode.co.uk/certifications/)

Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[projects@undercode.co.uk](mailto:projects@undercode.co.uk)
Smart Architecture | Secure by Design | Trusted by Thousands

References:

Reported By: [x.com](https://x.com/TweetThreatNews/status/2100691357991833982)
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
[Wikipedia](https://www.wikipedia.org)
OpenAi & Undercode AI

Image Source:

[Unsplash](https://unsplash.com/)
Undercode AI DI v2

JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

[ Whatsapp](https://undercode.help/whatsapp) | [ Telegram](https://t.me/UndercodeCommunity)

Follow UndercodeNews & Stay Tuned:

[???? formerly Twitter ](https://x.com/undercode_news) | [@ Threads](https://www.threads.net/@undercodenews) | [ Linkedin](https://www.linkedin.com/company/undercode-news/) | [BlueSky](https://bsky.app/profile/undercodenews.bsky.social) | [Mastodon](https://mastodon.social/@undercodenews) | [Youtube](https://www.youtube.com/undercodenews/community)