A variant of a ransomware strain known as DJVU has been observed to be distributed in the form of cracked software.
“While this attack pattern is not new, incidents involving a DJVU variant that appends the .xaro extension to affected files and demanding ransom for a decryptor have been observed infecting systems alongside a host of various commodity loaders and infostealers,” Cybereason