File encryption / ransomware deployment
Named by 2 kept items in this workspace.
Search every workspace for File encryption / ransomware deployment. It matches the name as written, so it can find other things that share it.
The items that name it 2
Files encrypted and renamed with .locked extension (July) or .locked_wip extension (September); ransom note RESTORE_FILES.txt dropped in multiple folders
win.exe and G_hlm7jj_windows_amd64.exe encryptors run with command-line flags like --password, --T, --superfast; files encrypted with extensions like .fjn1jw and ransom note README-GENTLEMEN.txt dropped
All techniques in this workspace.