- Recently, we discovered a new targeted ransomware attack created in the Go programming language.
- This was evidenced by the specific email addresses and credentials the ransomware used.
- One possible reason for this uptick in popularity is that Go statically compiles necessary libraries, making security analysis much harder.
Our investigation reveals that these samples targeted enterprises in Asia and Africa. Based on dark web posts by a user named Qilin (who seems to be connected to the ransomware distributors) and through ransom notes, the ransomware is called Agenda.
Agenda can reboot systems in safe mode, attempts to stop many server-specific services/processes, and has multiple modes to run. The samples we collected were customized for each victim, and they included unique company IDs and leaked account details.
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
Click Here For The Original Source.
