Settra Ransomware Disables Windows Recovery via reagentc /disable

Ibrahim Saud@tektrix

•updated Sep 18, 2026•2•0•5

Detects the execution of ReAgentC.exe with the /disable flag, which disables the Windows Recovery Environment (WinRE). This activity is often used by adversaries to prevent system recovery or to facilitate data impact, such as ransomware deployment.