Agenda RansomwareMalware
RansomwareFrom MISP Galaxy
Last reported 12 months ago, by Trend Micro Research2 reports
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“T1021.001 Remote Services: Remote Desktop Protocol”
- T1021.002SMB/Windows Admin Shares
“T1021.002 Remote Services: SMB/Windows Admin Shares”
- T1070Indicator Removal
“T1070 Indicator Removal”
- T1078.002Domain Accounts
“T1078.002 Valid Accounts: Domain Accounts”
- T1087.002Domain Account
“T1087.002 Account Discovery: Domain Account”
- T1110Brute Force
“Additionally, there are indications of brute force attempts targeting VPN devices prior to the incident.”
What the reports say
2 reports, newest first · the exact sentence from each-
Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques“Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques”
-
Qilin Revisited: Diving into the techniques and procedures of the recent Qilin Ransomware Attacks“Qilin, also known as Agenda Ransomware, has been particularly active and successful in its operations, having compromised over 150 organizations across 25 countries and spanning a diverse array of industries.”
Thanks — we review every report.