The Agenda ransomware group has significantly enhanced their offensive capabilities by integrating the SmokeLoader malware and a novel .NET-based loader, NETXLOADER, into their toolkit.
This upgrade, first observed in attacks starting in November 2024, signals a leap in their technical expertise, enabling them to bypass traditional security measures more effectively while amplifying the destructive potential of their operations.
Recent data from early 2025 reveals that Agenda ransomware has primarily targeted sectors such as healthcare, technology, finance, and telecommunications. Their reach spans across several countries, including the United States, the Netherlands, Brazil, India, and the Philippines.
In a notable shift, the ransomware itself has transitioned from the Go programming language to Rust. This change brings with it improved capabilities, such as remote execution and advanced self-propagation, especially within virtualized environments.
Researchers at Trend Micro have uncovered that SmokeLoader now functions as a secondary payload, while NETXLOADER acts as the initial loader, setting the stage for the execution of the malicious payloads.
“The introduction of NETXLOADER increases the likelihood of sensitive data breaches and device takeovers, thanks to its highly evasive nature,” stated the research team in their detailed report published on May 7, 2025.
NETXLOADER is associated with a complex network of malicious domains designed to slip under the radar. These domains, such as bloglake7[.]cfd, mxbook17[.]cfd, and mxblog77[.]cfd, appear to be innocuous blog-related sites but are, in fact, transient and disposable platforms that host the malware.
This attack chain begins with the deployment of NETXLOADER, moves through SmokeLoader, and culminates in the activation of Agenda ransomware. The multi-stage process ensures that the infection remains concealed, optimizing both the delivery and execution of the malicious payload.
NETXLOADER Analysis – A Breakthrough in Loader Technology
NETXLOADER represents a major leap forward in malware loader technology, fortified with advanced obfuscation techniques via .NET Reactor 6. These techniques, including control flow obfuscation, anti-tamper measures, and anti-ILDASM protections, significantly complicate reverse engineering efforts, making it extremely difficult for analysts to dissect its functionality.
At its core, NETXLOADER utilizes a dynamic loading process, extracting an assembly from a decrypted resource. It then proceeds to loop through the types in the assembly, invoking obfuscated methods via reflection to avoid detection.
A defining feature of NETXLOADER is its use of Just-In-Time (JIT) hooking, specifically targeting the compileMethod() function within the clrjit.dll library. By hooking into this function, NETXLOADER dynamically replaces placeholder methods with actual MSIL bytecode during runtime, a technique that allows it to bypass conventional security monitoring systems.
The loader’s structure exemplifies sophisticated evasion strategies, as shown in the code snippet below:
C#
// Token: 0x06000002 RID: 2 RVA: 0x000020B4 File Offset: 0x00000284
public static void Main()
{
string username = Environment.UserName;
Assembly assembly = null;
try
{
assembly = Assembly.Load(username);
}
catch
{
assembly = Assembly.Load(Kjeeqlm.Duivbgikpyx().Decrypt());
}
Type[] types = assembly.GetTypes();
for (int i = 0; i < types.Length; i++)
{
Type type = types[i];
if (!(type == null) && !type.IsEnum)
{
try
{
type.InvokeMember(“c0AqjVLHS”, BindingFlags.InvokeMethod, null, null, null);
}
catch
{
}
}
}
}
Upon successful decryption, NETXLOADER employs AES encryption to decrypt its embedded payload, which is then further unpacked using GZipStream. The payload consists of shellcode that, upon execution, activates SmokeLoader, setting the stage for the final execution of Agenda ransomware.
The malware’s distribution process is meticulously designed. Once on the victim’s system, the executable files are given pseudo-random names, such as rh10j0n.exe. However, these names are simplified to a more standard format, typically following a two- or three-letter prefix followed by “111.exe.” This tactic is meant to create the illusion of legitimate files, while also disassociating the true nature of the payload from its file name.
