Ransomware victims pay, but scammers want more