> A better method might be "get 5 people infected", regardless of payment. If you don't require payment, anyone could just spin up five VMs and infect them, th

> A better method might be "get 5 people infected", regardless of payment. If you don't require payment, anyone could just spin up five VMs and infect them, then request a decryption key. Not saying these guys are clever or anything and the scheme seems likely to fail for the reasons you mention, but I think something like a "get two other people infected and they pay up" scheme is the most workable version.