Linux RATs on Windows: Ransomware Actors Target VMware Deployments

The article discusses a sophisticated ransomware attack by the Agenda group, which targets VMware deployments by deploying Linux ransomware variants on Windows systems. The attack utilizes WinSCP for file transfer and Splashtop Remote management software to execute payloads, bypassing traditional security measures. The campaign specifically targets VMware infrastructure and backup systems, employing techniques like bring-your-own-vulnerable-driver (BYOVD) to evade detection.

The attackers compromise backup systems, harvest credentials, and create redundant access channels using legitimate remote management tools. The Agenda group has been active in 2025, targeting high-value sectors such as manufacturing and healthcare, emphasizing the need for organizations to reassess their security measures against hybrid threats.