A Mole exposing itself to sunlight

Fox-IT observed an active ransomware campaign named "Mole" spread via a social-engineering exploit kit that lures users to install a malicious Office "plugin"; upon execution it terminates processes, removes Windows backups, encrypts files with a .MOLE extension (RSA-1024), and displays a ransom note. The report provides infection statistics (500+ infections, many unique IPs suggesting targeted organizations), multiple IoCs (two binary hashes, several download hostnames, and a C2 IP), and ransom contact addresses.