No idea what is actually going on, but the "simple" scenario is that it is just a mafia-style bust out. If that's the case, the attackers don't want the source

No idea what is actually going on, but the "simple" scenario is that it is just a mafia-style bust out. If that's the case, the attackers don't want the source or future development, they want to extract as much money as possible without regard to Nginx as an ongoing concern.