"Once the encryption process was complete a file called RecoveryManual.html was left across the filesystem with the instructions on how to contact the threat actors for the ransom negotiations." Read the full report: https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours #DFIR #ThreatIntel