Agenda (Ransomware Group) – Threat Actor

Agenda Ransomware Group
Other Names	Qilin, Water Galura, AgendaCrypt
Location	Unknown
Date of initial activity	2022
Suspected attribution	Unknown
Associated Groups	Unknown
Motivation	Financial gain
Associated tools	Agenda malware. Agenda ransomware group uses Remote Monitoring and Management (RMM) tools, as well as Cobalt Strike for deployment of the ransomware binary. As for the Agenda ransomware executable, it can also propagate via PsExec and SecureShell, while also making use of different vulnerable SYS drivers for defense evasion.
Active	Yes

Overview

Agenda is an emerging ransomware family, that has recently been targeting critical sectors such as healthcare and education industries. At present, they appear to be migrating their ransomware code to Rust as recent samples still lack some features seen in the original binaries written in the Golang variant of the ransomware.

Common targets

Agenda Ransomware Group has been primarily United States, Argentina, Australia, and Thailand, and it has been targeting industries critical to the economy, such as finance, law, healthcare, and education.

Attack Vectors

Agenda targets its victims through phishing emails that contain malicious links to gain a foothold in the victim’s network and exfiltrate sensitive data.

How they operate

Agenda targets its victims through phishing emails that contain malicious links to gain a foothold in the victim’s network and exfiltrate sensitive data. Once Agenda completes initial access, they typically move laterally across the victim’s infrastructure, searching for essential data to encrypt.

During the encryption process, the actors place a ransom note in each infected directory of the system, which provides instructions on how to purchase the decryption key. They may also attempt to reboot systems in normal mode and stop server-specific processes to make it harder for the victim to recover their data.

If the ransomware operator is successful in encrypting a victim’s files, it uses a double extortion technique as a means to increase its potential revenue.

Significant Attacks

Agenda ransomware was used to target several industries, such as finance and law. Agenda ransomware detections increased beginning December 2023.

Agenda ransomware group uses Remote Monitoring and Management (RMM) tools, as well as Cobalt Strike for deployment of the ransomware binary.

Campaigns:

Agenda continues infecting victims globally with the US, Argentina, Australia, and Thailand being among its top targets. (March 2024)
Agenda ransomware targets healthcare and education sectors in countries like Thailand and Indonesia. (December 2022)
Qilin Targets its victims by sending phishing emails that contain malicious links to gain access to their network. (July 2023)

References: