Here’s one for the books: ransomware that’s disguised as a free anti-ransomware decryption tool. The sample we looked at claims to be a decryptor for the DJVU ransomware, which gets its name from the .djvu extension it appends to files that it’s just scrambled.
https://nakedsecurity.sophos.com/2020/06/08/double-crossing-ransomware-decryptor-scrambles-your-files-again/
https://nakedsecurity.sophos.com/2020/06/08/double-crossing-ransomware-decryptor-scrambles-your-files-again/