Agenda Ransomware Group Upgraded Their Arsenal With SmokeLoader and NETXLOADER

In a significant evolution of their attack capabilities, the Agenda ransomware group has recently incorporated SmokeLoader malware and a new .NET-based loader dubbed NETXLOADER into their arsenal. This development, observed in campaigns initiated during November 2024, marks a substantial upgrade in the threat actor’s technical sophistication and ability to evade detection mechanisms while maximizing the […] The post Agenda Ransomware Group Upgraded Their Arsenal With SmokeLoader and NETXLOADER appeared first on Cyber Security News.

May 8, 2025 - 02:50

Agenda Ransomware Group Upgraded Their Arsenal With SmokeLoader and NETXLOADER

In a significant evolution of their attack capabilities, the Agenda ransomware group has recently incorporated SmokeLoader malware and a new .NET-based loader dubbed NETXLOADER into their arsenal.

This development, observed in campaigns initiated during November 2024, marks a substantial upgrade in the threat actor’s technical sophistication and ability to evade detection mechanisms while maximizing the impact of their attacks.

According to recent attack data from the first quarter of 2025, Agenda ransomware has primarily targeted organizations in healthcare, technology, financial services, and telecommunications sectors.

The geographical scope of these attacks spans multiple countries including the United States, the Netherlands, Brazil, India, and the Philippines.

Notably, the ransomware itself has undergone a transformation from being developed in the Go programming language to Rust, incorporating advanced features such as remote execution and enhanced propagation capabilities within virtual environments.

Trend Micro researchers identified that this new attack chain utilizes SmokeLoader as an intermediate payload, while NETXLOADER serves as the initial stage loader that facilitates the deployment of subsequent malicious components.

“The new loader poses an increased risk of sensitive data theft and device compromise to targets due to its stealthy behavior,” noted the research team in their comprehensive analysis released on May 7, 2025.

The emergence of NETXLOADER is tied to a sprawling infrastructure of malicious domains designed to evade detection.

Threat actors leverage disposable, dynamically generated domains such as bloglake7[.]cfd, mxbook17[.]cfd, and mxblog77[.]cfd to host payloads, often masquerading as benign blog-related services.

These domains follow a distinct pattern, combining words with randomized numbers and low-reputation top-level domains to create transient hosting platforms.

The attack chain begins with NETXLOADER, progresses through SmokeLoader, and culminates with the deployment of Agenda ransomware, creating a multi-stage infection process that maximizes stealth while ensuring effective payload delivery and execution.

Agenda ransomware attack chain (Source – Trend Micro)

Analysis of NETXLOADER

NETXLOADER represents a significant advancement in loader technology, protected with .NET Reactor 6 obfuscation that employs control flow obfuscation, anti-tamper, and anti-ILDASM features, making reverse engineering extremely challenging.

The loader dynamically loads an assembly from a decrypted resource, then iterates through its types to invoke methods with obfuscated names using reflection.

A key characteristic of NETXLOADER is its use of JIT hooking techniques, specifically targeting the compileMethod() function of the clrjit.dll library.

It hooks into this function to dynamically replace placeholder methods with actual MSIL bytecode at runtime, effectively evading traditional detection mechanisms.

The loader’s code structure reveals sophisticated evasion techniques:-

// Token: 0x06000002 RID: 2 RVA: 0x000020B4 File Offset: 0x00000284
public static void Main()
{
    string username = Environment.UserName;
    Assembly assembly = null;
    try
    {
        assembly = Assembly.Load(username);
    }
    catch
    {
        assembly = Assembly.Load(Kjeeqlm.Duivbgikpyx().Decrypt());
    }
    Type[] types = assembly.GetTypes();
    for (int i = 0; i < types.Length; i++)
    {
        Type type = types[i];
        if (!(type == null) && !type.IsEnum)
        {
            try
            {
                type.InvokeMember("c0AqjVLHS", BindingFlags.InvokeMethod, null, null, null);
            }
            catch
            {
            }
        }
    }
}

After decryption, NETXLOADER uses AES to decrypt its payload, which is then decompressed using GZipStream.

The decompressed payload contains shellcode that ultimately leads to the execution of SmokeLoader, which in turn downloads and executes the Agenda ransomware.

The malware distribution is carefully orchestrated, with the executables adopting standardized naming conventions on victim systems.

For example, files with pseudo-random names like rh10j0n.exe are simplified to a standard format with a two to three-letter prefix followed by 111.exe, creating a false sense of legitimacy while decoupling the payload’s identity from its filename.

Are you from the SOC and DFIR Teams? – Analyse Real time Malware Incidents with ANY.RUN -> Start Now for Free.

The post Agenda Ransomware Group Upgraded Their Arsenal With SmokeLoader and NETXLOADER appeared first on Cyber Security News.