Businesses have already paid more than $100,000 to DDoS extortionists who claim to be the dreaded Armada Collective, but that never DDoS anyone. The criminals requested to the victims the payment of a ransomware to avoid being targeted by powerful DDoS attacks. The extortion is a consolidated practice in the criminal ecosystem, groups like DD4BC used a consolidated scheme to convince victims to pay the ransomware. The group is the same that shut down the popular encrypted mail service ProtonMail in November 2015 and extorted $6,000.”]
Source: http://securityaffairs.co/wordpress/46702/cyber-crime/armada-collective.html