The group is abusing trusted remote management and file transfer tools to deliver a Linux encryptor on Windows machines.
The error message “To run this application, you first must install one of the following versions of the .NET Framework” ...