Experts observed cybercriminals are conducting a new malspam campaign to distribute a new variant of the GlobeImposter ransomware that appends the doc extension to encrypted files. The malicious messages pretend to have attached photos being sent to the recipient and have a subject line similar to Emailing: IMG_20171221_ The messages include 7zip (.7z) archive attachments that are named after a camera photos filename. Victims are instructed to visit the http://n224ezvhg4sgyamb.onion/sup.php onion site that provides an email address to contact contact ([email protected]) to receive payment instructions.”]
Source: https://securityaffairs.co/wordpress/67071/malware/globeimposter-ransomware-malspam-campaign.html