Salsa20 / ChaCha20 are quite nice when you want to do byte-for-byte file encryption. It's a good choice in a lot of situations. The unusually reduced number of

Salsa20 / ChaCha20 are quite nice when you want to do byte-for-byte file encryption. It's a good choice in a lot of situations. The unusually reduced number of rounds is more difficult to explain, since I expect hard drive I/O would be the bottleneck in almost any situation. Maybe it's just a little more "stealthy" to not have elevated CPU usage while the ransomware is incubating.