[wyldfire]

Earlier reports I'd heard said that this group was unprepared or poorly prepared to handle the incoming ransom. Many of these ransomware campaigns use a fully automated mechanism to deliver keys upon payment, this group did not.

[j_s]

One of the main pain points was using the same Bitcoin address as a destination rather than unique-per-victim... it gets confusing to prove who paid.

[koolba]

How does that work in practice? Do the decryption keys get stored in the block chain as well or out of band?

[pas]

out-of-band, probably sent via email or managed through the "malware app" itself.