The malware typically spreads through campaigns designed to exploit holiday-themed or administrative urgency:
It scans local drives and encrypts hundreds of file types using a custom cipher.
Victims are lured into clicking links that download a ZIP or RAR archive (like Merry X-Mas.rar ). Inside is often a malicious executable (e.g., COMPLAINT.pdf.exe ) or a Word document with a malicious macro. 2. Execution & Technical Behavior