This is how an insider ransomware cybercriminal gang works