RansomBoggs is also known by its alias, Sullivan, because the ransom note uses Monsters Inc. themes, claiming the encryption event was performed by no other than James P. Sullivan. Additionally, the contact information includes Monsters Inc. references, and the ransom note is titled SullivanDecryptsYourFiles.txt. Aside from that, RansomBoggs is a traditional crypto-ransomware that encrypts files using AES-256-CBC and encrypts the resulting key with RSA-2048 encryption (the ransom note claims it's AES-128, but it's AES-256-CBC). However, ESET researchers who discovered this variant attribute it to the Sandworm group, which is further attributed to the Russian GRU. The group used this variant, along with many others, in the conflict against Ukraine in late 2022.
Ransom note picture derived from ESET
