The Necurs botnet is the largest spam botnet in the world. It has been used primarily for the distribution of Locky ransomware and Dridex. Talos recently identified a significant increase in spam emails originating from the Necurs. The messages claim to be stock market alerts about a specific stock ticker ($INCT) that the messages claim is about to go higher. The message was structured to entice the user into thinking that this was too good of an opportunity to pass up — a classic get rich quick scheme.”]
Source: https://blog.talosintelligence.com/2017/03/necurs-diversifies.html