StopCrypt: Most widely distributed ransomware now evades detection

SonicWall researchers reported a new multi-stage variant of the StopCrypt (STOP/Djvu) ransomware that employs shellcodes, stack-built API calls, process hollowing, delayed loops, and persistence via ACL changes and scheduled tasks; it encrypts files (adding a .msjd extension) and drops _readme.txt ransom notes. The operation primarily targets consumers via malvertising and bundled adware, producing many low-dollar ransom demands rather than large enterprise extortion, and researchers later noted some analyzed samples may have been older while confirming the described tactics remain relevant.