Ziggo ransomware phishing campaign still increasing in size

Fox-IT SOC observed an active TorrentLocker ransomware campaign (October 2016) distributing via fake Ziggo invoice phishing e-mails that lead victims to download a ZIP containing JavaScript which downloads the ransomware; infected systems have files encrypted with a ".enc" extension. The report provides IoCs (malicious domains, an IP, SSL certificate details), notes that the malware steals address books to expand propagation, and describes network behavior (initial SSL C2 then Tor) and ongoing takedown/mitigation efforts.