Hmm,
Hackers that are doing ransom-ware with BTC, mainly the following reasons,
One it is easier for their victims to get ,
Easier for them to mix,
However we can't confirm that they don't use altcoins during the mixing process, because they might.
But the final conversion would be in BTC as more places to convert it back into Fiat, which is their main goal anyway.
(They used to have people send money from 7-eleven stores using money gram before they switched to BTC)https://7elevenmoneytransfer.com.au/As far as the arrival mechanism , lately they have been sending out mass emails, claiming to be an invoice in a Word Document.
User open the word doc, which triggers a Macro which downloads and triggers the virus.
The Virus runs in the background, and many users report the PC feeling slow or sluggish, once all of the files are encrypted,
It pops up on the screen with the ransom.
I seen a few different versions of this ransomware bugger.
1. User Workstation was hit and it encrypted every word, excel, picture on that PC and all of the server drives it had access too.
Removal of the virus is simple, as it work was done, luckily the company was professional and kept a nightly backup.
Restored the Server Backups, and they were up and running the next day.
(PC was Reformatted)2. Another User at another company was tricked into loading a trojan word file.
It also encrypted all files on the workstation and server.
Server was restored from the previous night's backup,
however there were no backups for all of the files that were being kept on the PC.
But they got lucky, this version of ransomware , did not delete the Shadow copies created by windows.
User lost ~2 days worth of work verses 3 years.
But there are newer versions that delete those shadow copies first, so that recovery option may not be possible.
Moral of the story a weekly backup to a drive that is not left connected to your PC will save your butt.
Not just from ransomware, but from hard drive failures.
Ransom guys charge a few hundred bucks , Data Recovery Firms charge in the
$Thousands. A 1TB USB drive is under $80 , It is the Cheapest Insurance you can buy for your Data.
FYI: Tips
If the User has no backups,
Place the Hard drive in a Secure System and make a data recovery image with something like GetDataBack software.
Then you can scan the image for any deleted files.
Then clean the virus from the hard drive, place back in original system and check to see if any shadow copies are available.
http://www.shadowexplorer.com/If all of those fail, then the users may pay the ransom, but get them setup with a backup procedure so it never happens again.