Ransomware Spotlight: Agenda - TrendMicro

Its initial activity in July 2022 was observed to deploy Go-based ransomware that offered affiliates customizable builds for encryption behavior, file targeting, and ransom note personalization. Later that year, it introduced Rust-based variants to improve performance and cross-platform support that included Windows, Linux, and ESXi environments. Its recent campaigns were observed to leverage PowerShell-based tooling for lateral movement and deployment in VMware vCenter and ESXi environments. In 2024 and 2025, the Agenda ransomware saw a significant operational expansion, where affiliates were observed using additional malware loaders such as SmokeLoader and NETXLOADER, along with defense-evasion techniques including “Bring Your Own Vulnerable Driver” (BYOVD). In some incidents, the group deployed Linux ransomware payloads via legitimate remote management tools; this emphasized the group’s flexibility and effectiveness as an industry-agnostic extortion operation.