Shadowroot Ransomware Lures Turkish Victims via Phishing Attacks

ShadowRoot is a ransomware campaign targeting Turkish businesses that uses phishing emails with PDF invoice attachments to deliver a Delphi binary (RootDesign.exe) hosted on a compromised GitHub account. The malware drops multiple files, creates recursive self-processes that result in repeated encryption and many encrypted file copies, and is described by researchers as rudimentary; defenders are advised to block several identified sender email addresses.