Hidden Tear, open-sourced as part of an educational project, was used for at least 24 real-life ransomware strains. Researchers from Kaspersky have discovered that some of the code used in some of these strains was used in the Cryptear.B and Linux.Encoder ransomware families. Ransom-Ransom.MSIL.Tear.c was specifically altered to encrypt only files found on the user’s desktop. Some of the variants used C&C servers to send encryption keys into thin air.”]