New Golang Ransomware Dubbed Agenda Targets Organizations
A new ransomware written in the Go language has been targeting healthcare and education enterprises in Asia and Africa. This ransomware is customized per victim, and spreads to connected machines if successfully executed.
Save to Folio
- Recently, we discovered a new targeted ransomware attack created in the Go programming language.
- This was evidenced by the specific email addresses and credentials the ransomware used.
- One possible reason for this uptick in popularity is that Go statically compiles necessary libraries, making security analysis much harder.
Our investigation reveals that these samples targeted enterprises in Asia and Africa. Based on dark web posts by a user named Qilin (who seems to be connected to the ransomware distributors) and through ransom notes, the ransomware is called Agenda.
Agenda can reboot systems in safe mode, attempts to stop many server-specific services/processes, and has multiple modes to run. The samples we collected were customized for each victim, and they included unique company IDs and leaked account details.