https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html