Malware

Agenda Ransomware

Agenda ransomware is a ransomware family notable for deploying a Linux variant on Windows systems. This cross-platform deployment is achieved using remote management tools and Bring Your Own Vulnerable Driver (BYOVD) techniques, allowing the ransomware to bypass security controls and escalate privileges. The group behind Agenda demonstrates technical sophistication in leveraging these methods. There is no direct attribution to a specific threat actor or nation-state in the provided content. The malware targets both Linux and Windows environments, indicating a focus on organizations with heterogeneous infrastructure. No specific industries or geographies are mentioned as primary targets. Indicators of compromise or detailed behavioral characteristics beyond the deployment techniques are not provided in the current context.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

To execute the Linux binary on Windows systems, the attackers likely enabled Windows Subsystem for Linux (WSL)

T1059.001PowerShellEvidence1

“Agenda will use a custom PowerShell script embedded in the binary to propagate across VMWare vCenter and ESXi servers.”

T1059.003Windows Command ShellEvidence1

“The most recent version of the Agenda ransomware contains multiple command-line arguments.”

Persistence

1 technique

T1098Account ManipulationEvidence1

“It connects to the host names specified by the attacker and changes the root password for all ESXi hosts.”

Privilege Escalation

1 technique

T1098Account ManipulationEvidence1

“It connects to the host names specified by the attacker and changes the root password for all ESXi hosts.”

Stealth

2 techniques

T1211Exploitation for Defense EvasionEvidence1

“[Actors are] employing the Bring Your Own Vulnerable Driver (BYOVD) technique to evade detection by security systems.”

T1480Execution GuardrailsEvidence1

“The latest version of Agenda can now terminate VMclusters… by executing… PowerShell -Command ‘Stop-Cluster -Force’.”

Lateral Movement

2 techniques

T1021.004SSHEvidence1

“SSH would then be enabled for file transfer… [then] creating an SSH session that will be used to upload the ESXi binary.”

T1570Lateral Tool TransferEvidence1

“Agenda has also changed its propagation command-line to --spread… PsExec is dropped… [and] executed… -c -f -h -d '{Malware File Path}'.”

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

WinSCP was utilized for secure file transfer of the Linux ransomware binary to the Windows system

T1219Remote Access ToolsEvidence1

“Agenda ransomware group uses Remote Monitoring and Management (RMM) tools, as well as Cobalt Strike for deployment of the ransomware binary.”

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

“Agenda also added a feature to print ransom notes on connected printers.”

T1489Service StopEvidence1

“The latest version of Agenda can now terminate VMclusters… PowerShell -Command ‘Stop-Cluster -Force’.”

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

“[Agenda is] leveraging different vulnerable drivers to disable different security tools… Spyboy’s Terminator tool [is] used to bypass AVs and EDRs.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app9 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securityaffairsNews

Nov 2, 2025

Security Affairs newsletter Round 548 by Pierluigi Paganini – INTERNATIONAL EDITION

Ransomware deploying Linux variant on Windows systems using remote management and BYOVD techniques.

securityaffairsNews

Nov 2, 2025

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 69

Agenda Ransomware is known for deploying ransomware payloads, including a Linux variant, on Windows systems using remote management tools and Bring Your Own Vulnerable Driver (BYOVD) techniques.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Agenda Ransomware