Agenda ransomware made its return with a Rust variant

Threat Level

Attack Report

For a detailed threat advisory, download the pdf file here

Summary

In addition to BlackCat, Hive, Luna, and RansomExx, Agenda is the latest ransomware strain to use the cross-platform programming language Rust. Ransomware-as-a-service (RaaS) group Agenda, attributed to an operator named Qilin, has been linked to a spate of attacks mainly targeting manufacturing and IT industries. The earlier version of the ransomware, which was written in Go and customized for each victim, targeted the education and healthcare sectors in Indonesia, Saudi Arabia, South Africa, and Thailand.