Malware

AgendaCrypt

Also known as: Agenda · Qilin

Ransomware written in Go.

Indicators of Compromise 1

Filename C:\PerfLogs\

MITRE ATT&CK TTPs 8

Remote Desktop Protocol

Lateral Movement

Windows Management Instrumentation

Clear Windows Event Logs

Defense Evasion

System Information Discovery

Data Destruction

Steal or Forge Kerberos Tickets

Credential Access

Source Articles

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Qilin ransomware actors exploited a patched PAN-OS authentication bypass vulnerability (CVE-2026-0257) to gain initial access to victim networks by establishing unauthorized SSL VPN sessions. They then performed credential harvesting, lateral movement using PsExec, and deployed ransomware payloads while clearing logs and disabling Microsoft Defender. Variability in post-exploitation tactics suggests multiple affiliates operating under a ransomware-as-a-service model.

hacker-news ·1w ago