bbe983dba3bf319621b447618548b740

'GoXML.exe' ransomware-style file encryptor MD5 from CISA AA22-264A Appendix A. Drops the ransom note How_To_Unlock_MyFiles.txt and is propagated across the victim print-server network by 'mellona.exe'. Mandiant tracks the same family as ROADSWEEP, which dropped a politically themed anti-MEK note for the HomeLand Justice persona.

family

ROADSWEEP

first seen

Jul 14, 2022

publisher

CISA