Colmobil: SETTRA Ransomware Named in Attack on Israel's Largest Car Importer

"The SETTRA ransomware group was behind the October 14, 2026 cyberattack on Colmobil, Israel's largest vehicle importer, Calcalist and its English edition Ctech reported on October 28, exactly two weeks after the…"

The SETTRA ransomware group was behind the October 14, 2026 cyberattack on Colmobil, Israel's largest vehicle importer, Calcalist and its English edition Ctech reported on October 28, exactly two weeks after the incident first came to light. The attribution comes from people familiar with the incident. It does not come from a leak-site post by the group or from the company itself. Those same people say SETTRA threatened to publish Colmobil customers' personal details unless a ransom was paid. The attack disrupted operations, and Israel's Ministry of Transport cut Colmobil off from the government system importers use to register new vehicles. The scale of the company matters here. According to Israel Vehicle Importers Association figures cited by Calcalist, Colmobil delivered 62,657 new cars in the first nine months of 2026, which is 24.5% of the Israeli market. Colmobil says it has returned to full operation and that "no information has been publicly exposed." It has declined to say whether it paid.

What Happened

On October 14, Colmobil sent a notice to its business partners. It said its technology team had "a few hours ago" identified an information security incident, that the company "had prepared for such an event," that dedicated teams were investigating, and that the relevant regulators had been notified. Calcalist notes that Israeli law requires attacked organisations to report to the relevant regulator, which in this case is the Israel National Cyber Directorate.

The operational impact soon became visible. The Ministry of Transport blocked Colmobil's access to "Rechavit," the system vehicle importers use to complete registration of new cars. Vietnam.vn describes the cut-off as temporary and meant to stop the infection spreading. The ministry itself has not published its reasoning. Over the following week, readers told Calcalist about service delays for Mercedes-Benz customers. Leasing company customers also reported that new-car deliveries had been postponed. Vietnam.vn adds that maintenance, registration and delivery services were all affected. Colmobil imports Mercedes-Benz, Hyundai, Mitsubishi, Ora, Jaecoo and other brands, so the disruption reached a large share of new-car buyers in Israel. Calcalist reports the company ran under altered conditions "for several days" before it restored normal operations.

Accounts differ on the ransom. Calcalist reports that Colmobil declined to comment on whether it paid. Vietnam.vn and Baomoi report that "industry sources" suggest Colmobil did pay. Colmobil has not confirmed this, and it remains an unverified claim.

What Was Taken

What was taken has not been confirmed. People familiar with the incident told Calcalist that SETTRA threatened to publish customers' personal details online. That implies the attackers took data before encrypting systems, which is the group's usual double-extortion pattern. No outlet has reported which categories of customer data are involved, how many people are affected, or whether anything has actually been published. Colmobil's position is that no information has been publicly exposed. No regulator has published a notice that gives a record count or data types.

For context, Colmobil's customer base covers tens of thousands of new-car buyers every year, plus service and leasing customers. Any personal data held for vehicle sales, financing, registration and servicing would be valuable to extortionists. Until Colmobil or the National Cyber Directorate says more, the extent of the theft is unknown.

Why It Matters

Calcalist describes this as the first cyberattack on a vehicle importer in Israel. It shows how much of the country's car supply chain runs through a single company. Importers sit between manufacturers, government registration systems, payment processors, leasing firms and service networks. In this case, one compromised company led a government ministry to cut a digital link, and that in turn stopped deliveries for thousands of customers. Ctech's analysis argues the incident exposes weaknesses in Israel's connected-car ecosystem, where even replacing a wheel involves billing, inventory and payment systems.

Vietnam.vn and Baomoi stress a limit: there is currently no evidence that the attackers reached or controlled vehicle control systems. This was a corporate IT intrusion, not a compromise of the cars. They also report, citing Calcalist, that the Ministry of Transport recently issued guidelines requiring importers to adopt cybersecurity policies, appoint a responsible officer, monitor threats, and assess supplier security. Vietnam.vn adds that the National Cyber Directorate has moved to strengthen defences across the economy, though it gives no specific measures.

On the group itself, Calcalist cites international reporting that SETTRA avoids critical infrastructure and government targets, promises victims their data will not leak if they pay, and has previously hit financial, healthcare and retail organisations. Huntress, which has investigated the variant directly, says SETTRA was first observed in June 2026. Its two cases were a consumer services and retail organisation in July and a manufacturer in September. The Colmobil attack fits a fast-growing operation that goes after commercial targets with large customer datasets.

The Attack Technique

How the attackers got into Colmobil has not been disclosed. Colmobil has not said, and the people quoted by Calcalist did not describe the entry point.

What is known about SETTRA comes mainly from Huntress's September 17, 2026 technical write-up, which is based on two intrusions it investigated. Huntress did not investigate Colmobil, so its findings describe how the group usually operates. They are not evidence of what happened at Colmobil.

Initial access: Public reporting cited by Huntress says SETTRA operators have entered through VPNs or with compromised credentials. Huntress could not confirm the entry vector in its own two cases.
Persistence: The attackers installed remote monitoring and management (RMM) tools, including MeshAgent, to keep access.
Tailored payloads: In both cases the ransomware executables were named after the victim organisation's domain, which points to preparation specific to each victim.
Defence evasion: Operators cleared Windows event logs and disabled Windows recovery options. One incident showed signs of Bring Your Own Vulnerable Driver (BYOVD), where attackers load a legitimate but flawed driver to disable security tools. In that same incident, a typo by the attackers left them unable to clear the Windows Defender event log, which left evidence in place.
Impact: Files were encrypted and RESTORE_FILES.txt ransom notes were dropped, alongside the data-theft threat typical of double extortion.

What Organizations Should Do

Lock down remote access. Enforce phishing-resistant MFA on every VPN and remote access gateway, keep VPN appliances fully patched, and alert on logins from unusual locations or at unusual times. Stolen credentials and VPN access are SETTRA's reported way in.
Inventory and restrict RMM tools. Keep an allowlist of approved remote management software and block or alert on unapproved agents such as MeshAgent. A new RMM install on a server should trigger investigation immediately.
Detect log clearing and recovery tampering. Alert on Windows Security and System log clearing (Event IDs 1102 and 104), on vssadmin or wbadmin deletions, and on bcdedit changes that disable recovery. Forward logs off-host so an attacker who clears them locally does not erase your record.
Block vulnerable drivers. Turn on Microsoft's vulnerable driver blocklist and enforce driver-loading controls to reduce BYOVD attacks that disable endpoint protection.
Plan for losing your connections to partners. Importers, distributors and other businesses connected to government or partner systems should expect those links to be cut during an incident. Rehearse manual fallbacks for registration, delivery and payments so a cut-off does not stop the whole business.
Reduce and segment customer data. Limit how much personal data sits in reachable systems, encrypt it at rest, and watch for large outbound transfers. In double extortion, restoring from backup does not remove the leverage of stolen data.

Sources: SETTRA Ransomware Hits Colmobil: Oct. 14 Attack 2026 | Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent... | Ransomware group SETTRA behind cyberattack on Israel’s largest car... | Colmobil cyberattack exposes vulnerabilities in Israel’s connected-... | סייבר בענף הרכב: פרטי קבוצת הכופרה שתקפה את כלמוביל נחשפים כלכליסט | Colmobil Ransomware Attack: SETTRA Threatens Customer Data — vpn.so... | Cyberattack targets Israel's largest car importer. | Tấn công mạng nhằm vào doanh nghiệp nhập khẩu ôtô ...