AgendaCrypt—also tracked as Qilin or Agenda—is a modern ransomware threat that's been active since at least 2022. Unlike older file-encrypting malware that relied on simple distribution methods, AgendaCrypt operates as part of a Ransomware-as-a-Service (RaaS) model, meaning criminal affiliates rent access to the malware infrastructure and split profits with its developers. This business model has made AgendaCrypt particularly persistent and well-funded, with attacks targeting businesses and home users who appear to have valuable data. The ransomware comes in multiple variants written in both Golang and Rust programming languages, making detection and analysis more challenging for traditional antivirus products.
Threat Profile
| Canonical Name | AgendaCrypt |
| Known Aliases | Qilin, Agenda |
| First Observed | 2022 (active continuously) |
| File Type | Windows PE executable (32-bit and 64-bit variants) |
| Language Variants | Golang and Rustlang compiled binaries |
| Target Platform | Windows (all versions from 7 onward) |
| Distribution Model | Ransomware-as-a-Service (RaaS) with affiliate operators |
| Encryption Method | Hybrid cryptography (AES + RSA typical for this family) |
| Extortion Tactics | Double extortion: file encryption + data exfiltration/leak threats |
| Typical Ransom | $50,000–$500,000 (corporate); $2,000–$10,000 (individual victims) |
| Detection Coverage | Moderate (varies by variant and AV vendor) |
| Threat Level | High—sophisticated operation with ongoing development |
How It Spreads
AgendaCrypt doesn't spread through traditional mass-mailing campaigns or random infections. Because it's a RaaS operation, each affiliate group uses their own preferred attack methods, but most follow a similar playbook. The attackers typically gain initial access through compromised Remote Desktop Protocol (RDP) credentials, exploited VPN vulnerabilities, or phishing emails targeting specific employees with administrative access. Once inside a network, they move laterally—quietly exploring file shares, backup systems, and other connected machines—before deploying the ransomware payload across as many systems as possible in a coordinated strike.
The double-extortion model means attackers spend days or weeks inside your network before encryption begins. During this reconnaissance phase, they're identifying your most valuable files, locating backups to delete or encrypt, and exfiltrating copies of sensitive data to their servers. This stolen data becomes leverage: even if you restore from backups, they threaten to publish your files on leak sites unless you pay. For small businesses and home offices with client data, financial records, or proprietary information, this secondary threat can be as damaging as the encryption itself.
Common distribution vectors include:
- Brute-forced RDP access—weak passwords on internet-facing Remote Desktop connections
- Compromised VPN credentials—stolen through phishing or purchased from dark web credential markets
- Exploited vulnerabilities—unpatched software on servers or workstations (VPN appliances, web servers, outdated Windows versions)
- Phishing with malicious attachments—targeted emails to employees with administrative privileges
- Supply chain compromise—infection through trusted third-party software or managed service providers
- Malicious software installers—trojanized legitimate applications downloaded from unofficial sources
What It Does On Your Machine
Once executed, AgendaCrypt works methodically to maximize damage while avoiding detection for as long as possible. The malware first performs environment checks to determine if it's running in a virtual machine or sandbox—security researchers use these controlled environments to study malware, so many ransomware families try to detect and avoid them. If the checks pass, AgendaCrypt establishes persistence by creating scheduled tasks or registry entries that survive reboots, ensuring the encryption process completes even if interrupted.
The ransomware then terminates specific processes and services that could interfere with encryption or lock files it needs to encrypt. Database services (SQL Server, MySQL), backup applications (Veeam, Acronis), email servers (Exchange), and virtual machine managers are common targets—shutting these down ensures the malware can encrypt their data files. AgendaCrypt also attempts to delete Volume Shadow Copies (Windows' built-in restore points) and disable Windows Defender through registry modifications or Group Policy changes, cutting off your most accessible recovery options.
File encryption happens rapidly once preparations are complete. The malware scans all accessible drives—including mapped network shares—and encrypts files matching target extensions (documents, images, databases, archives, virtual machines). Each encrypted file typically receives a new extension and the malware drops ransom notes (usually named README.txt or similar) in affected directories. These notes contain instructions for contacting the attackers through Tor-based chat sites and unique victim identifiers.
Because AgendaCrypt operates as RaaS with multiple affiliate groups, specific indicators vary between attacks. Some variants may skip certain anti-forensic steps, while others include additional payloads like credential stealers or remote access tools that remain hidden even after encryption. The Golang and Rust variants also exhibit different file signatures and runtime behaviors, making consistent detection difficult without up-to-date threat intelligence.
Manual Removal — Step by Step
Isolate Immediately
Disconnect the infected machine from all networks—unplug ethernet, disable Wi-Fi, remove any USB drives or external storage. Do NOT shut down the computer yet; running ransomware sometimes completes encryption during shutdown. If other machines on your network are running, disconnect them too until you've confirmed they're clean. Time spent connected is time the infection can spread laterally.
Document the Infection
Photograph the ransom note with your phone. Note the file extension added to encrypted files and any unusual process names visible in Task Manager (Ctrl+Shift+Esc). Check the Recent Items folder (C:\Users\[username]\Recent) for when encryption started. This information helps determine the ransomware variant and whether decryption tools exist. Do NOT delete anything yet.
Boot into Safe Mode with Networking
Restart the computer and repeatedly press F8 (or Shift+F8 on newer systems) during boot to access Advanced Boot Options. Select "Safe Mode with Networking." This loads Windows with minimal drivers and services, preventing most malware—including AgendaCrypt—from running automatically. If you can't access Safe Mode, you'll need a bootable USB with rescue tools (created on a clean machine).
Run a Thorough Malware Scan
In Safe Mode, download and run Malwarebytes (free version is fine) and perform a full system scan. Also run Windows Defender's offline scan (Settings > Update & Security > Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan). These tools should detect and quarantine the AgendaCrypt executable, but they won't decrypt your files—that requires separate tools or backups.
Remove Persistence Mechanisms
Open Registry Editor (type "regedit" in Start menu) and navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries you don't recognize, especially those pointing to random .exe files in C:\ProgramData or temp folders. Delete suspicious entries. Also check Task Scheduler (taskschd.msc) for malicious scheduled tasks.
Restore Shadow Copies (If They Exist)
AgendaCrypt tries to delete Volume Shadow Copies, but sometimes fails or only partially succeeds. Open Command Prompt as administrator and type vssadmin list shadows. If any exist, you can restore previous versions of files by right-clicking them in Explorer, selecting Properties, and checking the "Previous Versions" tab. This won't fix everything, but may recover some critical documents.
Check for Public Decryption Tools
Visit No More Ransom (nomoreransom.org) and ID Ransomware (id-ransomware.malwarehunter.com) to see if a free decryption tool exists for your specific AgendaCrypt variant. Upload a ransom note and encrypted file sample to ID Ransomware for identification. As of this writing, no universal decryptor exists for AgendaCrypt, but law enforcement occasionally obtains and releases decryption keys after infrastructure takedowns.
Restore from Backups
If you have clean backups stored offline or in cloud storage that wasn't mapped as a drive letter, now is the time to restore. Verify the backup integrity first—scan backup files with updated antivirus before restoring to ensure the infection didn't spread there during the reconnaissance phase. Never restore from backups until you've confirmed the ransomware executable is completely removed.
Reset Credentials
Change passwords for all accounts accessed from the infected machine—especially email, banking, and business accounts. Use a clean device to do this. AgendaCrypt operations often involve credential theft during the initial compromise phase, so assume any passwords entered on the infected system before encryption are compromised. Enable two-factor authentication wherever possible.
Assess Network-Wide Exposure
If the infected machine was on a network, scan all other devices for indicators of compromise. Check server logs for unusual RDP connections, review firewall logs for suspicious outbound traffic, and verify backup systems weren't tampered with. AgendaCrypt affiliates often maintain access through backdoors even after the main payload is removed, so professional network forensics may be necessary for business environments.
Prevention
- Disable or secure RDP access. If you don't need Remote Desktop enabled, turn it off completely. If you do need it, require VPN connection first, use complex passwords, enable Network Level Authentication, and consider changing the default port 3389 to reduce automated scanning. Never expose RDP directly to the internet.
- Implement network segmentation. Don't run your home or business as one flat network where every device can see every other device. Use VLANs or separate network zones to isolate critical systems. If ransomware gets onto one machine, segmentation limits how far it can spread laterally.
- Maintain offline backups. The 3-2-1 rule: three copies of data, on two different media types, with one stored offline. External hard drives should be disconnected after backup completion. Cloud backups are useful but not sufficient alone—attackers often target cloud-mapped drives. Test restore procedures regularly.
- Keep systems patched and updated. Enable automatic updates for Windows, install security patches promptly, and don't run unsupported operating systems like Windows 7 or Server 2008. Ransomware affiliates actively scan for known vulnerabilities in VPN appliances, web servers, and outdated software versions.
- Use endpoint protection with behavioral detection. Traditional antivirus isn't enough against modern ransomware. Deploy endpoint detection and response (EDR) tools that monitor for suspicious behaviors like mass file encryption, shadow copy deletion, or unusual process execution patterns. For home users, Windows Defender with ransomware protection enabled provides baseline protection.
- Train users on phishing recognition. Most initial compromises involve some human interaction—clicking a link, opening an attachment, or entering credentials on a fake login page. Regular training on spotting suspicious emails, verifying sender authenticity, and questioning unexpected attachments significantly reduces risk.
- Implement principle of least privilege. Users shouldn't run with administrator rights for daily tasks. Create separate admin accounts for system changes and use standard user accounts for everything else. Ransomware running under standard user context can't modify system files, disable security software, or delete shadow copies easily.
- Monitor for early indicators. Set up alerts for failed RDP login attempts, unusual outbound network connections, scheduled task creation, or mass file modifications. Early detection during the reconnaissance phase—before encryption begins—gives you time to isolate systems and prevent full compromise.
Bring It In
Ransomware recovery requires more than just running antivirus software. AgendaCrypt's double-extortion model means sensitive data may have been stolen even if you restore from backups, and residual backdoors can allow attackers to return weeks or months later. At Computer Repair Roswell, we approach ransomware cases methodically: forensic analysis to determine infection scope, complete malware removal with verification, secure data recovery when possible, and hardening recommendations to prevent recurrence. We've handled dozens of ransomware cases for Roswell-area businesses and residents, and we understand the urgency when your data is locked.
If you're facing an active AgendaCrypt infection or want to secure your systems against ransomware threats before they strike, call us at (770) 856-1525 or stop by our Roswell shop at 1000 Mansell Road. We offer emergency same-day service for active infections and free initial consultations to assess your vulnerability. Don't negotiate with criminals alone—let us give you an honest assessment of your recovery options and help you get back to work safely. Ransomware is serious, but it's not hopeless when you have experienced professionals on your side.