Ransom attackers switch to Monero