Agenda Ransomware Bypasses EDR by Deploying Linux Binary on Windows via Splashtop; Steals Veeam Credentials

Trend Research has identified a sophisticated ransomware campaign by the Agenda group, also known as Qilin, which utilizes a Linux-based ransomware binary to target Windows systems. This cross-platform attack circumvents traditional endpoint protections by employing legitimate remote management tools like WinSCP and Splashtop.

Since January 2025, over 700 victims across 62 countries, particularly in the US, France, Canada, and the UK, have been affected, with key industries including manufacturing, technology, financial services, and healthcare. The attackers use social engineering to gain initial access, leveraging stolen credentials to bypass multifactor authentication and establish persistence through backdoor accounts. They specifically target Veeam backup systems to extract credentials, crippling recovery options post-attack.

The campaign also employs a Bring Your Own Vulnerable Driver (BYOVD) technique for evading detection, allowing the ransomware to execute across both Windows and Linux environments.