---
title: Agenda Ransomware Hits 591 Victims Worldwide Using Cross-Platform Attack Strategy
description: Agenda ransomware infects 591 victims globally, exploiting remote tools and targeting backup systems, with U.S. leading in attacks.
canonical_url: https://codekeeper.co/ticker/agenda-ransomware-infects-591-victims-globally
---

# Agenda Ransomware Hits 591 Victims Worldwide Using Cross-Platform Attack Strategy

Agenda ransomware infects 591 victims globally, exploiting remote tools and targeting backup systems, with U.S. leading in attacks.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 26, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

The Agenda ransomware group (also called Qilin) has infected 591 victims across 58 countries since January 2025, with the U.S. leading at 295 incidents. Trend Micro researchers discovered the group's sophisticated approach: deploying Linux ransomware on Windows systems while exploiting legitimate remote access tools to avoid detection. The attackers use fake Google CAPTCHA pages to steal credentials, then target backup systems like Veeam to harvest more passwords and disable recovery options. Manufacturing (92 incidents), technology (68), and healthcare (61) sectors face the heaviest attacks. This cross-platform strategy bypasses traditional Windows-focused security tools, making detection extremely difficult. Organizations using remote access platforms or hybrid Windows/Linux environments face the highest risk. **Source:** [Industrial Cyber](https://industrialcyber.co/ransomware/agenda-ransomware-abusing-remote-access-backup-tools-to-escalate-attacks-on-critical-infrastructure-in-2025/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fagenda-ransomware-infects-591-victims-globally%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Critical N-Central Flaw Gives Hackers Full Admin Access to MSP Platforms Aug 11, 2026](https://codekeeper.co/ticker/critical-n-central-rmm-vulnerability-cve-2026-18577)

[Data breaches NHS Worker Shared Patient Records With Partner, Victims Demand Justice Aug 20, 2026](https://codekeeper.co/ticker/somerset-nhs-data-breach-patient-privacy-concerns)

[Hackers Exploiting Critical WordPress Plugin Flaw in Tens of Thousands of Attacks Aug 12, 2026](https://codekeeper.co/ticker/everest-forms-pro-plugin-vulnerability-exploit)

[Cyberattacks Fake Recruiters Infected 30,000 PCs in a $10.7M Crypto Theft Sep 21, 2026](https://codekeeper.co/ticker/fake-recruiter-scheme-north-korea-hackers)