It's a lot more likely that the attackers make money via the markets than via a direct ransom.