The STOP Ransomware has seen very heavy distribution over the last month using adware installers disguised as cracks. This campaign continues with a new variant released over the past few days that appends the.rumba extension to the names of encrypted files. The main difference is in this. version the ransomware will append the. rumba. extension to a file’s name after it is encrypted as shown below. In each. folder that a file is encrypted, the. ransomware will create a ransom note named _openme.txt that contains instructions on how to contact the attacker for payment instructions.
Source: https://www.bleepingcomputer.com/news/security/new-rumba-stop-ransomware-being-installed-by-software-cracks/