A new malspam campaign pretending to be the current emergency exit map for the recipient’s building is being used to install the GandCrab Ransomware. These spam emails contain malicious Word documents that download and install the infection from a remote computer. These emails state that they are coming from Rosie L. Ashton and have a subject of “Up to dat.. ..m..rg..n..y ..xit map”” These emails are being distributed by a server that was previously distributing the Ursnif banking Trojan.”
Source: https://www.bleepingcomputer.com/news/security/beware-of-exit-map-spam-pushing-gandcrab-v51-ransomware/