Quote:A new malspam campaign pretending to be the current emergency exit map for the recipient's building is being used to install the GandCrab Ransomware. These spam emails contain malicious Word documents that download and install the infection from a remote computer.

According to Myonlinesecurity.co.uk, who discovered this campaign, a server that was previously distributing the Ursnif banking Trojan has now started pushing GandCrab Ransomware v5.1. BleepingComputer decided to take a look at the spam emails and the files being distributed so that you can see how this campaign works.

As previously stated, this latest malspam campaign is pretending to be updated emergency exit maps for the recipient's building. These emails state that they are coming from Rosie L. Ashton and have a subject of "Up to datе еmеrgеnсy еxit map". Attached to these spam emails is a Word document titled Emergencyexitmap.doc as shown below.