Cross-platform ransomware is making waves in the cybersecurity realm, with the notorious Agenda group, also known as Qilin, leveraging Linux binaries to infiltrate Windows systems. This strategic twist has allowed them to evade traditional Windows defenses and hit over 700 targets since the beginning of 2025, as noted by Trend Micro. Using common remote management and file transfer tools, Agenda bypasses standard detection methods. They’re not just stopping there; by using tactics like a Bring Your Own Vulnerable Driver (BYOVD), they effectively neutralize endpoint protection.

Chirag Mehta from Constellation Research highlights the alarming synergy between cross-platform strategies and the exploitation of remote tools. By deploying a Linux encryptor and disabling endpoint detection with BYOVD, Agenda creates a formidable challenge for security teams, blurring the lines between operating systems to advance their agenda.

Agenda’s methodology is as intricate as it’s insidious, starting with social engineering bait like deceptive CAPTCHA pages. Once in, they gather credentials and bypass multi-factor authentication, creating a backdoor account for deeper access. Using legitimate Windows processes and tools like ScreenConnect, they sneakily map the network and exploit vulnerabilities. Their innovative use of software like AnyDesk ensures continued access across compromised networks.

They don’t stop at surface infiltration; by targeting backup systems like Veeam and utilizing PowerShell scripts, they extract sensitive credentials. Custom executables further disable security software, maintaining their hold over varied environments. For instance, PuTTY SSH clients extend their reach into Linux systems cohabiting with Windows ones. This network of control spans key sectors like manufacturing and finance, highlighting the broader implications of cross-platform ransomware in today’s interconnected world.

Addressing such multifaceted threats requires a shift in security paradigms. As Mehta advises, robust protection isn’t just about bolstering Windows defenses. With ransomware like Agenda exploiting cross-platform tactics, organizations must focus on identity security, RMM integrity, and hypervisor security. Closing detection gaps between Windows and Linux systems is crucial, alongside ensuring kernel driver integrity to prevent lateral movements.

In sectors that rely heavily on remote management tools, simply discarding these indispensable systems isn’t practical. Instead, security strategies should aim at consolidating tools to approved platforms, adopting just-in-time access measures, and segregating management from operational traffic. Backups deserve special attention, viewed as separate secure environments with isolated networks and immutable storage solutions.

For the latest on cybersecurity threats and expert insights, subscribe to our newsletter, where you’ll find invaluable guidance to stay one step ahead.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.