Settra is a double-extortion ransomware operation that surfaced in June 2026. On an affected Windows host, encrypted data carries a .locked or .locked_wip suffix, and a text file named RESTORE_FILES.txt sits in affected folders. That note opens by insisting the outage is a deliberate intrusion rather than a fault, warns against renaming or deleting files, and steers the victim to a Tor-hosted chat using a per-victim login ID. Victims span manufacturing, retail, technology and services across North America, Europe and Asia. The encryptor binary has been named after the target's own domain with a _win64.exe suffix, and intrusions have paired it with a MeshAgent remote-management implant, event-log wiping and removal of Windows recovery options. A leak blog lists organisations that decline to negotiate, and multi-terabyte data sets have been posted there. No lineage to an earlier family has been established.
File extensions: .locked, .locked_wip
Ransom note filenames: RESTORE_FILES.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161