The “Blank Slate” malspam campaign has switched to distributing a GlobeImposter variant that appends the .crypt extension to encrypted files. This downloaded executable is also code signed to make it appear more legitimate. […]

from https://www.bleepingcomputer.com/news/security/crypt-globeimposter-ransomware-distributed-via-blank-slate-malspam/