A new Ransomware-as-a-Service (RaaS) portal named Dot-Ransomware is behind the Unlock26 ransomware discovered this past week. The site features a minimal and direct style, with little-to-no instructions and simple-designed ransom notes and ransom payment portal. The service is still under development and not yet ready to be deployed, but we doubt it will happen after working so hard to reach this advanced stage of development. We suspect the signatures are most likely used to display unique Bitcoin addresses for each user accessing the payment site.
Source: https://www.bleepingcomputer.com/news/security/new-raas-portal-preparing-to-spread-unlock26-ransomware/