After a two-week break in campaign activity, the actors behind the distribution of Locky Affid=3 and Dridex 220/7200/7500 have introduced a new ransomware called “Jaff”. The group has introduced new ransomware before in similar fashion, specifically the Bart ransomware. While Bart was only seen several times in email, and then spread via exploit kit (EK) campaigns, it remains to be seen how Jaff will be used.