{"id":55683,"date":"2024-03-26T00:00:00","date_gmt":"2024-03-26T00:00:00","guid":{"rendered":"urn:uuid:2d8afdcd-fd1c-b51a-7e0f-5b2a776b0189"},"modified":"2024-03-26T00:00:00","modified_gmt":"2024-03-26T00:00:00","slug":"agenda-ransomware-propagates-to-vcenters-and-esxi-via-custom-powershell-script","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/agenda-ransomware-propagates-to-vcenters-and-esxi-via-custom-powershell-script\/","title":{"rendered":"Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell Script"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Some drivers we have observed being leveraged by the Agenda ransomware is YDark<\/i>, a publicly available tool designed for kernel manipulation, as well as Spyboy\u2019s Terminator<\/i> tool used to bypass AVs and EDRs (Endpoint Detection and Response). Using different vulnerable drivers for defense evasion highlights how ransomware can adapt, presenting a significant challenge for cybersecurity defenses trying to stop it.              <\/p>\n

The Agenda ransomware\u2019s ability to spread to virtual machine infrastructure shows that its operators are also expanding to new targets and systems, therefore organizations should be aware of the group\u2019s activities and implement security measures to protect themselves from these kinds of ransomware, such as:<\/p>\n