I interviewed a ransomware service operator who was closing down.
https://securityandtechnology.org/blog/lessons-from-the-ashes-interview-and-analysis-of-the-fonixcrypter-closure/