Agenda Ransomware Targets ESXi and vCenter Servers (Campaign)

Researchers observed the Agenda (Qilin/Water Galura) ransomware group increasingly targeting organizations worldwide — notably in the US, Argentina, Australia, and Thailand — by leveraging a Rust ransomware variant and sophisticated deployment and lateral-movement techniques. The group uses RMM tools, Cobalt Strike, PsExec, SSH, and a custom PowerShell script to propagate to VMware vCenter and ESXi servers, employs BYOVD (vulnerable drivers) to evade defenses, and has added unusual tactics such as printing ransom notes to networked printers, posing a significant threat to virtualized infrastructure and targeted sectors (finance, law).