The malware called SamSam helped hackers steal $ 6 million in cryptocurrency from a lot of victims. The group of hackers selects a specific target group and then they close the chosen system. As ransom they demand a certain price in cryptocurrency.
Because the hackers probably operated from Iranian territory, it is difficult for authorities to pick them up and expel the suspect. According to the US Justice Report, two Iranian citizens were behind the SamSam attack. The malware was mainly aimed at public institutions such as hospitals, schools and municipalities.