Pysa Ransomware, also know by its former name Mespinoza Ransomware is typically distributed via malspam, malvertising campaign, exploit kits, drive-by downloads, and brute-forcing accounts on servers that have RDP exposed to the Internet. Pysa encrypts data using AES-256 the keys for which are then encrypted with RSA.

MountLocker ransomware encrypts company and business user data with ChaCha20 + RSA-2048. It then demands a $ 2 million ransom in BTC to get the files back.It gives the hacked company 3 days and threatens to publish the stolen data "all over the Internet" in order to increase pressure on the victim.

Ranzy Locker Ransomware is the successor of Ako Ransomware and ThunderX Ransomware. Update version contains a better encryption as ThunderX decryption tool became available at NoMoreRansom project's website. Beside enhancement in encryption and methods of ex-filtration, and the (now commonplace) use of a public "leak blog" to post victim data for those who do not comply with the ransom demand.

DarkSide ransomware highly selective and targeted toward its victims. Its victims are business users and enterprise data with it encrypts their data with Salsa20 + RSA-1024 and then demands a multi-million dollar in BTC as ransom to get the files back.

Egregor Ransomware is the successor of Maze Ransomware and Sekhmet Ransomware. Egregor ransomware allegedly compromise and steal data from more than 50 companies including the big fishes like Crytek, Ubisoft, Foxtons Group and Barnes and Noble.