MalasLocker operates a leak site that echoes their message, but with an interesting twist. They instruct companies to select a non-profit of their choice, make a donation, and provide proof of the transaction by forwarding the confirmation email. The group then verifies the authenticity of the email through the DKIM signature. However, it remains uncertain whether the attackers actually provide the decryptor to the targeted companies that comply with their demands.
