I'm wondering, why Sandstorm does not recognize and block Locky. Yesterday a E-Mail passed the UTM, with attached payment_document_659857.zip, containing *.js scripts. The ZIP was not encrypted and for my unterstanding Sandstorm should have analyzed…