The organization that’s encrypting computers and extorting companies has taken to SegWit addresses, according to McAfee and CipherTrace
Source: coindesk