The Shade Ransomware (Troldesh) was the most actively distributed malware via malicious email phishing campaigns in H1 2019. The most widespread tools used in attacks tracked by Group-IB have been Troldesh (53%), RTM (17%) and Pony Formgrabber (6%) The latest malware strain is a strain sold or rented on various crimeware markets and a ransomware known for using constantly changing Tor command-and-control (C2) servers that make it harder to block. The FBI issued a public service announcement on October 2 regarding the increasing number of high-impact ransomware attacks targeting both public and private U.S. organizations.
Source: https://www.bleepingcomputer.com/news/security/shade-ransomware-is-the-most-actively-distributed-malware-via-email/