could you counterattack the ransomware operators by setting up an untold number of sacrificial VMs loaded up with filler files and then infecting them all? at the very least it would bog down their “negotiations” website, which seems to generate a specific ID for each compromised system.