Michael Gillespie discovered a new Cryptomix variant uploaded to ID-Ransomware this week. The ransom note is still named _HELP_INSTRUCTION.TXT, but now uses system [email protected], [email protected], and [email protected]. The next noticeable change is the extension appended to encrypted files. At this time the ransomware cannot be decrypted for free. As this is just a cursory analysis, if anything else is discovered, we will be sure to update this article.
Source: https://www.bleepingcomputer.com/news/security/system-cryptomix-ransomware-variant-released/