On 19 July. Elliptic carried an article which follows a real case involving the REvil ransomware – from initial infection and negotiation, through to the cryptocurrency payment and laundering of the funds.
https://www.elliptic.co/blog/revil-revealed-tracking-ransomware-negotiation-and-payment
Any modest contributions for my time and ongoing expenses are welcomed! I have a page where you can do so, and where contributions start as low as $3, at https://www.buymeacoffee.com/KoIvM842y