ERIS

The ransomware adds ".eris" to infected files and uses Salsa20 and RSA-1024 encryption. Variants of this malware are known to be distributed in drive-by-downloads via exploit kits. Payment instructions are sent to the victim after sending an encrypted file via email to the threat actor.