A new tactic is being used by ransomware actors in their ransomware notes. These malicious actors are now posting advertisements to solicit insider information. Researchers believe that multiple groups including Sarcoma and another group impersonating LockBit are using the new strategy. The ransomware note attempts to entice the employee to give up insider information, offering rewards in exchange. The actor then details how an interested employee can open a letter to launch a virus onto their work computer. 

Read more: https://www.darkreading.com/threat-intelligence/cybercriminals-traitorous-insiders-ransom-notes