StopCrypt: Most widely distributed ransomware evolves to evade detection

SonicWall and BleepingComputer report a newly-observed StopCrypt (STOP/Djvu) variant that uses a multi-stage execution chain—including shellcode, dynamically constructed API calls, process hollowing, delayed loops, and persistence via ACL changes and a scheduled task—to evade detection and encrypt user files (appending a ".msjd" extension) while leaving a "_readme.txt" ransom note; the campaign primarily targets consumers through malvertising and bundled adware, and researchers have noted concerns that the analyzed sample may be an older build.