May 2018 Campaigns

5/3/2018,"sales contract received|confirmation transfer", rtf -> pony,Attachment,10
5/4/2018,"PAYMENT CORRECTION", doc -> lokibot,Attachment,11
5/4/2018,Subjects contain combinations of initial first name and last name, passworded doc -> ransomware continued into 5/5,Attachment,4
5/5/2018,All subjects contain "Document #|Order #|Ticket #|Payment #|Ticket #", zip  -> vbs-> gandcrab ransomware ,Attachment,645
5/8/2018,All subjects contain "書", xls -> bebloh,Attachment,39
5/8/2018,"Reversed PI", doc -> lokitobt,Attachment,11
5/8/2018,All subjects contain "DocuSign", link -> doc -> evilpony -> pony -> pandbanker,Link,469
5/9/2018,"PAYMENT OVERDUE_#8801691207", xls -> lokibot,Attachment,3
5/10/2018,"Re: Wire confirmation details", jar -> adwind,Attachment,3
5/14/2018,All subjects contain "efax", link -> doc -> evilpony -> pony -> pandabanker,Link,488
5/16/2018,All subjects contain "2018.5", xls -> urlzone -> ursnif,Attachment,80
5/16/2018,"You have a new encrypted  message", doc -> trickbot,Attachment,3
5/16/2018,Subjects contain "report-<digits>|papers-<digits>", doc -> trickbot,Attachment,4
5/17/2018,Highjacked subject included "Order", doc -> ursnif,Attachment,2
5/17/2018,"900:Extention/Price list", zip -> pony,Attachment,
5/21/2018,"OP<digits>_PayAdv", link -> jar -> qrat,Link,3
5/22/2018,All subjects contain "fattura|ordine", xls -> ursnif,Attachment,6
5/24/2018,All subjects contain "IRS|Internal Revenue Service", link -> doc -> hancitor -> pony -> evilpony -> pandabanker,Link,5000
5/25/2018,"Unpaid invoice  [ID:<digits>]", iqy -> link -> flawedammyy rat,Attachment,75
5/29/2018,"FW: Important Account Documents", doc -> trickbot,Attachment,12
5/29/2018,"Purchase Order", rar -> lokibot,Attachment,3
5/30/2018,"FW: Company Compliant #<digits>", doc -> trickbot,Attachment,5
5/30/2018,"Enquiry Urgent", doc -> betabot,Attachment,2
5/31/2018,All subjects contain "HelloFax", link -> doc -> evilpony -> pony -> pandbanker,Link,7734