Worldwide Agenda Ransomware Wave Targets VMware ESXi Servers

Agenda (aka Qilin/Water Galura) has deployed a new Rust-based ransomware variant that actively targets VMware vCenter and ESXi servers; attackers deliver it via Cobalt Strike or RMM, use an embedded PowerShell to propagate and change ESXi host root passwords, upload payloads via SSH, and execute commands filelessly while employing evasion techniques including vulnerable drivers (BYOVD).