The ransomware gang has also started using the BatLoader dropper and SEO poisoning for initial access.