With the present Yoroi wishes to inform you about a dangerous campaign of attack in progress in recent days against Italian organizations. The attacks are characterized by the abuse of email communications that actually occurred between victims and e-mail addresses that send infected e-mails. This modus operandi has already been detected during various waves of Ursnif attack campaigns during 2018, reported in the Early Warning bulletins N010518 , N040318 , N040618 and N040718 .

https://blog.yoroi.company/warning/ondata-di-attacchi-con-archivi-cifrati/